MITRE ATT&CKtechnique

T0886 Remote Services

Published 2021-04-12 Modified 2026-10-13 Official page ↗
Domain
ics
Tactics
Initial Access, Lateral Movement
Platforms
Embedded, Windows, Linux, Network Devices
Version
1.1
Created
2021-04-12

Description

Adversaries may leverage remote services to move between assets and network segments. These services are often used to allow operators to interact with systems remotely within the network, some examples are RDP, SMB, SSH, and other similar mechanisms. Remote services could be used to support remote access, data transmission, authentication, name resolution, and other remote functions. Further, remote services may be necessary to allow operators and administrators to configure systems within the network from their engineering or management workstations. An adversary may use this technique to access devices which may be dual-homed to multiple network segments, and can be used for Program Download or to execute attacks on control devices directly through Valid Accounts. Specific remote services (RDP & VNC) may be a precursor to enable Graphical User Interface execution on devices such as HMIs or engineering workstation software. Based on incident data, CISA and FBI assessed that Chinese state-sponsored actors also compromised various authorized remote access channels, including systems designed to transfer data and/or allow access between corporate and ICS networks.

Related

Tactic · MITRE ATT&CK (2)

  • TA0108 Initial Access tactic
  • TA0109 Lateral Movement tactic

Referenced by MITRE ATT&CK · mitigates (9)

  • M0800 Authorization Enforcement mitigation
  • M0801 Access Management mitigation
  • M0804 Human User Authentication mitigation
  • M0937 Filter Network Traffic mitigation
  • M0807 Network Allowlists mitigation
  • M0930 Network Segmentation mitigation
  • M0813 Software Process and Device Authentication mitigation
  • M0918 User Account Management mitigation
  • M0927 Password Policies mitigation

Referenced by MITRE ATT&CK · uses (8)

  • C0063 2025 Poland Wiper Attacks campaign
  • C0030 Triton Safety Instrumented System Attack campaign
  • G1027 CyberAv3ngers group
  • C0028 2015 Ukraine Electric Power Attack campaign
  • C0025 2016 Ukraine Electric Power Attack campaign
  • S1045 INCONTROLLER software (malware)
  • S0603 Stuxnet software (malware)
  • S0496 REvil software (malware)

References