aol.pm

Exploitation of Remote Services

Technique · ATTACK:enterprise:T1210

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1210",
  "title": "Exploitation of Remote Services",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1210",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--9db0cf3a-a3c9-4012-8268-123b9db6fd82",
  "external_id": "T1210",
  "domain": "enterprise",
  "created": "2018-04-18T17:59:24.739Z",
  "modified": "2026-08-04T20:30:55.427Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "lateral-movement"
  ],
  "source_references": [
    {
      "source_name": "Broadcom VMSA-2024-0019",
      "url": "https://github.com/vmware/vcf-security-and-compliance-guidelines/blob/main/security-advisories/vmsa-2024-0019/README.md"
    },
    {
      "source_name": "CIS Multiple SMB Vulnerabilities",
      "url": "https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-windows-smb-server-could-allow-for-remote-code-execution/"
    },
    {
      "source_name": "Ars Technica VMWare Code Execution Vulnerability 2021",
      "url": "https://arstechnica.com/information-technology/2021/02/armed-with-exploits-hackers-on-the-prowl-for-a-critical-vmware-vulnerability/"
    },
    {
      "source_name": "NVD CVE-2016-6662",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6662"
    },
    {
      "source_name": "NVD CVE-2017-0176",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-0176"
    },
    {
      "source_name": "NVD CVE-2014-7169",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7169"
    }
  ]
}

Explicit source assertions (34)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0143 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--052b685c-6d95-4a98-86f1-4c9bb39a398c

Kaspersky Flame · Kaspersky Flame Functionality

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0694f0b0-c7c1-43c6-8024-17122fda2bc4

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e12dc13-6f73-4ad9-9cb5-845d443b4d58

FireEye WannaCry 2017 · LogRhythm WannaCry · US-CERT WannaCry 2017

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14f3eebf-40c3-48d5-ad62-356d57ccf2dc

FireEye KEGTAP SINGLEMALT October 2020 · DFIR Ryuk's Return October 2020 · DFIR Ryuk in 5 Hours October 2020

ATTACK:enterprise:M1016 → mitigates → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16fd4ddb-1ce4-4254-a301-8ac762573a77

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ba12f04-859e-471e-9dfd-4f74e402220d

SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cfc2e72-a9ce-4dc2-95ad-fb99c90a2880

ClearkSky Fox Kitten February 2020 · CrowdStrike PIONEER KITTEN August 2020 · ClearSky Pay2Kitten December 2020

ATTACK:enterprise:M1050 → mitigates → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2627d84f-081d-4b14-9d7d-5a1ca77d5869

TechNet Moving Beyond EMET · Wikipedia Control Flow Integrity

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--474d9df3-c596-4468-877a-85e4ad91ccbb

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--495db551-b69c-482e-b242-831011c054f7

TrendMicro EarthLusca 2022

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f2bd19b-f0f4-4946-a7a5-4947be3346b1

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--670efee1-b854-4d39-85b1-b6038e3580e3

Crowdstrike Qakbot October 2020

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6cb2f741-eedb-4b1d-8d84-7823f0095d44

Red Canary Emotet Feb 2019 · Secureworks Emotet Nov 2018 · Symantec Emotet Jul 2018 · US-CERT Emotet Jul 2018

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73fbf268-20d3-4549-9dd2-6e20e18079e0

Github PowerShell Empire

ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--754d1521-2fcf-4511-b7df-af4fffc7d635

Secure List Bad Rabbit

ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--771b78fb-4ed1-4c55-b5e8-31775eb60ad2

Talos Nyetya June 2017 · US-CERT NotPetya 2017 · US District Court Indictment GRU Unit 74455 October 2020

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b6688c8-4840-4617-b3b5-6009a7c674e7

AI-Mexico-Govt-Breach

ATTACK:enterprise:M1019 → mitigates → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d9c5216-da63-4b8f-ade7-a1854e43bd3f

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81cd9ad2-32ce-4a24-88cb-7dbe94c5a9f1

CISA GRU29155 2024

ATTACK:enterprise:M1048 → mitigates → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9492b31f-9275-4ee5-84bd-040cf653a6db

Ars Technica Pwn2Own 2017 VM Escape

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ff11dd9-23a1-46d9-913d-c580d45667f2

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a14c0cae-f7da-42d6-ab3c-f11746233e06

ESET InvisiMole June 2020

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a358f0a9-b5b9-4a84-8c83-dc0a1325d63e

FireEye APT28 · MS17-010 March 2017 · FireEye APT28 Hospitality Aug 2017

ATTACK:enterprise:S0608 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b56b122d-0a12-4b1a-854e-5c0826603121

SANS Conficker

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd1282fe-7a81-432b-9ac7-f93fb8f8b33f

GitHub PoshC2

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1a8eea8-f273-4dad-8ae0-d5c93bf5467f

Unit 42 Lucifer June 2020

ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d393d40d-d18a-4d89-9cc8-b57d3afaa9bf

TrendMicro Tonto Team October 2020

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e31ca67c-1662-4d27-b349-44f3dda2a872

Symantec Cicada November 2020

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e395b033-b699-4360-a436-1daeada439a2

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e56f602c-ec9f-46f0-a52f-45b90220314e

ESET Trickbot Oct 2020

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2aa88d9-852b-4932-9881-d9c6f5d89779

CISA AA20-296A Berserk Bear December 2020

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f53f17c6-b2ad-4201-8a26-ef53565a61af

DHS CISA AA22-055A MuddyWater February 2022

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9ec1b10-f819-42d8-a4b4-ecf015999cb6

Unit42 Emissary Panda May 2019

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe3872cb-5e08-4a04-9162-a6868ef95952

CrowdStrike Carbon Spider August 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.