T1133 — External Remote Services

# T1133 - External Remote Services

## SOC Recommendation
Investigate External Remote Services activity in the context of Persistence/Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Session Termination | Evict | Use Session Termination to remove the adversary's foothold once this technique is confirmed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Revoke session immediately | Medium | No | Yes |
| Block IP in Conditional Access Named Locations | Medium | No | Yes |
| Reset password and force MFA re-enrolment | Medium | No | Yes |
| Audit all actions taken during the Tor session | Low | No | Yes |

## KQL
```kql
let HighRiskPorts = dynamic([3389,20,23,110,143,3306,8080,1433,9200,9300,25,445,135,21,1434,4333,5432,5500,5601,22,3000,5000,8088,8888]);
AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/EC2.19"
      or tostring(ComplianceSecurityControlId) == "EC2.19"
| mv-expand Resource = Resources
| where tostring(Resource.Type) == "AwsEc2SecurityGroup"
| extend SGDetails = Resource.Details.AwsEc2SecurityGroup
| extend IpPermissions = SGDetails.IpPermissions
| mv-expand Perm = IpPermissions
| where toint(Perm.FromPort) in (HighRiskPorts)
| mv-expand Range = Perm.IpRanges
| where tostring(Range.CidrIp) in ("0.0.0.0/0", "::/0")
| summarize TimeGenerated = max(TimeGenerated), OpenHighRiskPorts = make_set(tostring(Perm.FromPort))
    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
       AwsSecurityFindingId, ComplianceSecurityControlId, SecurityGroupId = tostring(SGDetails.GroupId), SecurityGroupARN = tostring(Resource.Id)
| extend OpenHighRiskPorts = strcat_array(OpenHighRiskPorts, ", ")
```
```kql
ApacheHTTPServer
| where HttpRequestMethod =~ "GET"
| where UrlOriginal has_all ("/cgi-bin/", "/%2e%2e/")
| where HttpStatusCode == "200" 
| extend UrlCustomEntity = UrlOriginal
```
```kql
let cmd_list = dynamic(['whoami', 'dpkg', 'useradd', 'sudo', 'cat']);
ApacheHTTPServer
| where UrlOriginal has_any (cmd_list)
| extend UrlCustomEntity = UrlOriginal
```

## Escalation Criteria
- External Remote Services activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1133.json
• /api/recommendations/T1133.json
• /api/d3fend/T1133.json
• /api/mappings/T1133.json
• /api/confluence/T1133.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1133.json

Response:

{
  "technique_id": "T1133",
  "name": "External Remote Services",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Persistence",
    "Initial Access"
  ],
  "platforms": [
    "Containers",
    "Linux",
    "macOS",
    "Windows"
  ],
  "summary": "Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services...",
  "soc_recommendation": "Investigate External Remote Services activity in the context of Persistence/Initial Access: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-ST",
      "name": "Session Termination",
      "relationship": "evict",
      "practical_action": "Use Session Termination to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Sentinel",
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed external remote services activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"AWS Security Hub - Detect EC2 Security groups allowing unrestricted high-risk ports\" -- This query detects EC2 Security Groups that allow unrestricted (0.0.0.0/0 or ::/0) ingress to high-risk ports using AWS Security Hub control EC2.19 findings. Publicly exposed management, database, and service ports (e.g., RDP 3389, SSH 22, SQL 1433/3306) significantly increase the risk of brute-force attacks, exploitation, and lateral movement."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Revoke session immediately",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Block IP in Conditional Access Named Locations",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Reset password and force MFA re-enrolment",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Audit all actions taken during the Tor session",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "d2b6fa0f-6a4c-4c48-8c64-5e2e1ac4e7b9 — AWS Security Hub - Detect EC2 Security groups allowing unrestricted high-risk ports",
        "description": "This query detects EC2 Security Groups that allow unrestricted (0.0.0.0/0 or ::/0) ingress to high-risk ports using AWS Security Hub control EC2.19 findings. Publicly exposed management, database, and service ports (e.g., RDP 3389, SSH 22, SQL 1433/3306) significantly increase the risk of brute-force attacks, exploitation, and lateral movement. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let HighRiskPorts = dynamic([3389,20,23,110,143,3306,8080,1433,9200,9300,25,445,135,21,1434,4333,5432,5500,5601,22,3000,5000,8088,8888]);\nAWSSecurityHubFindings\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\n| where tostring(AwsSecurityFindingGeneratorId) == \"security-control/EC2.19\"\n      or tostring(ComplianceSecurityControlId) == \"EC2.19\"\n| mv-expand Resource = Resources\n| where tostring(Resource.Type) == \"AwsEc2SecurityGroup\"\n| extend SGDetails = Resource.Details.AwsEc2SecurityGroup\n| extend IpPermissions = SGDetails.IpPermissions\n| mv-expand Perm = IpPermissions\n| where toint(Perm.FromPort) in (HighRiskPorts)\n| mv-expand Range = Perm.IpRanges\n| where tostring(Range.CidrIp) in (\"0.0.0.0/0\", \"::/0\")\n| summarize TimeGenerated = max(TimeGenerated), OpenHighRiskPorts = make_set(tostring(Perm.FromPort))\n    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,\n       AwsSecurityFindingId, ComplianceSecurityControlId, SecurityGroupId = tostring(SGDetails.GroupId), SecurityGroupARN = tostring(Resource.Id)\n| extend OpenHighRiskPorts = strcat_array(OpenHighRiskPorts, \", \")"
      },
      {
        "name": "767f9dc4-3b01-11ec-8d3d-0242ac130003 — Apache - Apache 2.4.49 flaw CVE-2021-41773",
        "description": "Detects using Apache 2.4.49 flaw CVE-2021-41773' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "ApacheHTTPServer\n| where HttpRequestMethod =~ \"GET\"\n| where UrlOriginal has_all (\"/cgi-bin/\", \"/%2e%2e/\")\n| where HttpStatusCode == \"200\" \n| extend UrlCustomEntity = UrlOriginal"
      },
      {
        "name": "54da6a42-3b00-11ec-8d3d-0242ac130003 — Apache - Command in URI",
        "description": "Detects command in URI' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let cmd_list = dynamic(['whoami', 'dpkg', 'useradd', 'sudo', 'cat']);\nApacheHTTPServer\n| where UrlOriginal has_any (cmd_list)\n| extend UrlCustomEntity = UrlOriginal"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "53bb8f53-3550-4805-b6bd-728ded8d5564 — AWS Lambda Function URL Created with Public Access",
        "description": "(EQL) Identifies the creation or update of an AWS Lambda function URL configured with an authentication type of NONE, which exposes the function to unauthenticated invocation directly from the public internet... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "any where data_stream.dataset == \"aws.cloudtrail\"\n    and event.provider == \"lambda.amazonaws.com\"\n    and event.outcome == \"success\"\n    and not (user_agent.original : \"*terraform*\" or user_agent.original : \"*pulumi*\" or user_agent.original : \"*ansible*\")\n    and not (aws.cloudtrail.user_identity.arn : \"*terraform*\" or aws.cloudtrail.user_identity.arn : \"*pulumi*\" or aws.cloudtrail.user_identity.arn : \"*ansible*\")\n    and (event.action : \"CreateFunctionUrlConfig*\" or event.action : \"UpdateFunctionUrlConfig*\")\n    and stringContains(aws.cloudtrail.request_parameters, \"authType=NONE\")"
      },
      {
        "name": "d8f2a1b3-c4e5-6789-abcd-ef0123456789 — Ollama API Accessed from External Network",
        "description": "(EQL) Detects when the Ollama LLM server accepts connections from external IP addresses. Ollama lacks built-in authentication, so exposed instances allow unauthenticated model theft, prompt injection, and resource hijacking. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "network where event.action == \"connection_accepted\" and\n  process.name in (\"ollama\", \"ollama.exe\") and\n  destination.port == 11434 and\n  source.ip != null and source.ip != \"0.0.0.0\" and\n  not cidrmatch(source.ip, \n    \"10.0.0.0/8\", \n    \"127.0.0.0/8\", \n    \"169.254.0.0/16\", \n    \"172.16.0.0/12\", \n    \"192.168.0.0/16\",\n    \"100.64.0.0/10\",\n    \"::1\",\n    \"fe80::/10\",\n    \"fc00::/7\",\n    \"ff00::/8\"\n  )"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "External Remote Services activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1133 - External Remote Services Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}