Remote Services
Technique · ATTACK:enterprise:T1021
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1021",
"title": "Remote Services",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1021",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--54a649ff-439a-41a4-9856-8d144a2551ba",
"external_id": "T1021",
"domain": "enterprise",
"created": "2017-05-31T21:30:29.858Z",
"modified": "2025-10-24T17:48:48.472Z",
"version": "1.6",
"aliases": [
],
"tactics": [
"lateral-movement"
],
"source_references": [
{
"source_name": "Apple Remote Desktop Admin Guide 3.3",
"url": "https://images.apple.com/remotedesktop/pdf/ARD_Admin_Guide_v3.3.pdf"
},
{
"source_name": "Remote Management MDM macOS",
"url": "https://support.apple.com/en-us/HT209161"
},
{
"source_name": "Kickstart Apple Remote Desktop commands",
"url": "https://support.apple.com/en-us/HT201710"
},
{
"source_name": "Lockboxx ARD 2019",
"url": "http://lockboxx.blogspot.com/2019/07/macos-red-teaming-206-ard-apple-remote.html"
},
{
"source_name": "FireEye 2019 Apple Remote Desktop",
"url": "https://www.fireeye.com/blog/threat-research/2019/10/leveraging-apple-remote-desktop-for-good-and-evil.html"
},
{
"source_name": "TechNet Remote Desktop Services",
"url": "https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx"
},
{
"source_name": "Apple Unified Log Analysis Remote Login and Screen Sharing",
"url": "https://sarah-edwards-xzkc.squarespace.com/blog/2020/4/30/analysis-of-apple-unified-logs-quarantine-edition-entry-6-working-from-home-remote-logins"
},
{
"source_name": "SSH Secure Shell",
"url": "https://www.ssh.com/ssh"
}
]
}Explicit source assertions (22)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1be5193d-55e6-42ab-90ff-3ff73693848f
AI-Mexico-Govt-BreachATTACK:enterprise:T1021.006 → subtechnique-of → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22e8b7b4-7e5f-45a8-a935-c4cc7da638f2
ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a062b27-636e-4164-9156-65631d140765
Sygnia ESXi Ransomware 2024ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4340d15d-5577-4b4e-8e5b-570b9ab3a147
Mandiant FIN12 Oct 2021ATTACK:enterprise:T1021.005 → subtechnique-of → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47acf59d-7476-4794-b359-747da52f196c
ATTACK:enterprise:T1021.002 → subtechnique-of → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5071c70a-5aa8-4534-8cc4-676192728151
ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a076d46-bd2f-4572-b993-36b4c1fb25d3
ESET DazzleSpy Jan 2022ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6da682e8-f3e0-41ed-95f2-c268c686abd1
ATTACK:enterprise:T1021.007 → subtechnique-of → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7097c7b2-9266-4659-955b-38214d5ada8c
ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--795ca238-c8cf-4735-98cc-593f1cc59b16
ATTACK:enterprise:T1021.001 → subtechnique-of → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8787d75b-9c28-437d-b6b5-93d2d7e8462e
ATTACK:enterprise:T1021.003 → subtechnique-of → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--950c7be9-c84d-4543-9f3b-71eae9019fe4
ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a340fa8-70c5-4bf6-a8c2-6e28e3fc8b59
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S0437 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a51ea812-182b-47d8-94c2-331e4d9973f5
TrendMicro BlackTech June 2017ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3cf2464-2602-4a88-8e7a-dda56eff05ff
Google Cloud Threat Intelligence ESXi Hardening 2023 · Broadcom ESXi Lockdown ModeATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cadbc1b1-aa69-4120-982e-cb306143d759
Crowdstrike HuntReport 2022ATTACK:enterprise:T1021.008 → subtechnique-of → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc1f7b0c-a443-46ee-b9d6-b7ecb9ead9fa
ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df3c4e4d-9766-4673-ab1f-2210ecc50764
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df529a76-525d-4a35-a9d2-48ec41f71459
ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7240735-0936-49b9-a4ff-16cb0aa06e07
Cadet Blizzard emerges as novel threat actorATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed9cb2bb-5c45-45f1-a0d5-4458609a5ab5
ATTACK:enterprise:T1021.004 → subtechnique-of → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8c320cc-97f5-4b3a-8847-92c42b6a48b7