Remote Services (T1021)

View on ATT&CK

In Playbook

Associated Tactics

  • Lateral Movement

Lateral Movement (TA0008)

The adversary is trying to move through your environment. Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target and subsequently gaining access to it. Reaching their objective often involves pivoting through multiple systems and accounts to gain. Adversaries might install their own remote access tools to accomplish Lateral Movement or use legitimate credentials with native network and operating system tools, which may be stealthier.

View on ATT&CK

Procedure Examples

Description Source(s)
Apple. (n.d.). Apple Remote Desktop Administrator Guide Version 3.3. Retrieved October 5, 2021. Apple Remote Desktop Admin Guide 3.3
Apple. (n.d.). Use MDM to enable Remote Management in macOS. Retrieved September 23, 2021. Remote Management MDM macOS
Apple. (n.d.). Use the kickstart command-line utility in Apple Remote Desktop. Retrieved September 23, 2021. Kickstart Apple Remote Desktop commands
Dan Borges. (2019, July 21). MacOS Red Teaming 206: ARD (Apple Remote Desktop Protocol). Retrieved September 10, 2021. Lockboxx ARD 2019
Jake Nicastro, Willi Ballenthin. (2019, October 9). Living off the Orchard: Leveraging Apple Remote Desktop for Good and Evil. Retrieved August 16, 2021. FireEye 2019 Apple Remote Desktop
Microsoft. (n.d.). Remote Desktop Services. Retrieved June 1, 2016. TechNet Remote Desktop Services
Sarah Edwards. (2020, April 30). Analysis of Apple Unified Logs: Quarantine Edition [Entry 6] – Working From Home? Remote Logins. Retrieved August 19, 2021. Apple Unified Log Analysis Remote Login and Screen Sharing
SSH.COM. (n.d.). SSH (Secure Shell). Retrieved March 23, 2020. SSH Secure Shell