Remote Services

What is Remote Services?

“Remote Services is documented as technique T1021 in MITRE ATT&CK® v19.1 under the Lateral Movement tactic. Detection requires visibility into SIEM, Firewall telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Remote Services activity. These methods apply across SIEM, Firewall environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor RDP authentication events for logons from unusual source hosts, particularly from workstations connecting to servers or from hosts that have not previously used RDP to access specific destinations.

2. 2

   Alert on WinRM and PowerShell remoting sessions initiated outside of normal administrative workflows, particularly those executing unusual command sequences or spawning additional processes on remote systems.

3. 3

   Detect SMB lateral movement by monitoring for authentication to Admin shares (C$, IPC$, ADMIN$) combined with subsequent file creation or process execution on the target systems.

4. 4

   Implement UEBA rules that baseline normal remote service usage patterns per user and alert on deviations including new destination systems, unusual connection times, and unusually high numbers of remote sessions.

5. 5

   Monitor for pass-the-hash and pass-the-ticket artifacts in authentication logs, including NTLM authentication events for accounts where only Kerberos is expected or vice versa.

Example Alerts

These realistic alert examples show what Remote Services looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Remote Services?

Detection centers on SIEM, Firewall telemetry for the lateral movement phase of the attack. Monitor RDP authentication events for logons from unusual source hosts, particularly from workstations connecting to servers or from hosts that have not previously used RDP to access specific destinations. Alert on WinRM and PowerShell remoting sessions initiated outside of normal administrative workflows, particularly those executing unusual command sequences or spawning additional processes on remote systems.

What does a Remote Services alert look like?

A representative SIEM detection is "RDP Lateral Movement Chain Detected" (critical severity): Authentication correlation detected systematic RDP lateral movement: account DA_svc_backup used RDP to connect sequentially to 8 systems over 35 minutes. Pattern started from initial compromised host, moved to file servers, then domain controller. Each hop occurred within 3-5 minutes of arrival on the previous system, consistent with automated lateral movement tooling.

Which tools detect Remote Services, and how can I practice?

Remote Services (T1021) is best surfaced with SIEM, Firewall telemetry, which exposes the lateral movement signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.