Remote Services

Monitor executed commands and arguments that may use Valid Accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.

Malicious actors may rename built-in commands or external tools, such as those provided by SysInternals, to better blend in with the environment. In those cases, the file path name is arbitrary and may blend in well with the background. If the arguments are closely inspected, it may be possible to infer what tools are running and understand what an adversary is doing. When any legitimate software shares the same command lines, it must be whitelisted according to the expected parameters.

Any tool of interest with commonly known command line usage can be detecting by command line analysis. Known substrings of command lines include

• PuTTY
• port forwarding -R * -pw
• secure copy (scp) -pw * * @
• mimikatz sekurlsa::
• RAR  -hp
• Archive* a * Additionally, it may be useful to find IP addresses in the command line
• \d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}

Analytic 1 - Suspicious Arguments

port_fwd = filter process where (command_line match "-R . -pw")scp = filter process where (command_line match "-pw . . .@."mimikatz = filter process where (command_line match "sekurlsa")rar = filter process where (command_line match " -hp ")archive = filter process where (command_line match ". a .*")ip_addr = filter process where (command_line match \d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})

Monitor for user accounts logged into systems they would not normally access or abnormal access patterns, such as multiple systems over a relatively short period of time. Correlate use of login activity related to remote services with unusual behavior or other malicious or suspicious activity. Adversaries will likely need to learn about an environment and the relationships between systems through Discovery techniques prior to attempting Lateral Movement. For example, in macOS you can review logs for "screensharingd" and "Authentication" event messages. ^[7][13]

Note: When using Security event id 4624, %$ means user names that do not end with $ character. Usually, computer accounts or local system accounts names end with the $ character. When using Security event 4624, UserName and UserLogonId correspond to TargetUserName and TargetLogonId respectively. When using Security event 4624, LogonType 3 corresponds to a Network Logon

Analytic 1 - New services being created under network logon sessions by non-system users

remote_logon_sessions = filter Hostname, UserName, UserLogonId, SourceIp where event_id == "4624" AND LogonType == "3" AND UserName NOT LIKE '%$'

new_services = filter UserName, UserLogonId, ServiceName where event_id = "4697"

suspicious_services = filter l.UserName, l.UserLogonId, l.SourceIp, s.ServicenameFROM remote_logon_sessions lINNER JOIN new_services sON l.UserLogonId = s.UserLogonId

Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes, that may use Valid Accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.

Note: On Windows, Sysmon Event ID 7 (Image loaded) can be used to monitor the loading of DLLs into processes, including those designed to accept remote connections. This is a particularly noisy event and can generate a large volume of data, so we recommend baselining and filtering out any known benign processes and module to help reduce the number of events that are produced.

Monitor interactions with network shares, such as reads or file transfers, using remote services such as Server Message Block (SMB).

Monitor for newly constructed network connections that may use Valid Accounts to log into a service specifically designed to accept remote connections, such as RDP, telnet, SSH, and VNC. Monitor network connections involving common remote management protocols, such as ports tcp:3283 and tcp:5900, as well as ports tcp: 3389 and tcp:22 for remote login.

Note: Network Analysis frameworks such as Zeek can be used to capture, decode, and alert on network service protocols such as SSH and RDP.

Analytic 1 - Suspicious Protocols

suspicious_protocol = filter network_traffic where ((server_port = "636" AND protocol = "6") OR (server_port = "389" AND protocol = "17"))

Monitor for newly executed processes that may use Valid Accounts to log into a service specifically designed to accept remote connections, such as RDP, telnet, SSH, and VNC. The adversary may then perform actions that spawn additional processes as the logged-on user.

Monitor for newly constructed WMI objects that is often used to log into a service that accepts remote connects.