t1021 | LoFP

t1021

Title	Tags
a file server may experience high-demand loads that could cause this analytic to trigger.	t1021 t1021.002 endpoint splunk
administrative activity	t1003 t1016 t1021 t1021.001 t1027 t1036 t1053 t1053.005 t1059 t1059.001 t1059.005 t1071 t1071.001 t1087 t1087.001 t1087.002 t1098 t1105 t1133 t1134 t1136 t1136.001 t1137 t1222 t1222.001 t1505 t1505.004 t1552 t1552.006 t1555 t1555.004 t1562 t1562.001 t1572 t1615 windows linux sigma
administrative activity using a remote port forwarding to a local port	t1021 t1021.001 t1021.004 t1572 windows sigma
administrative scripts	t1021 t1021.002 t1039 t1048 t1055 t1059 t1059.001 t1059.005 t1137 t1218 t1543 t1543.003 windows sigma
administrator may allow inbound traffic in certain network or machine.	t1021 t1021.001 endpoint splunk
administrators	t1021 t1021.002 windows sigma
administrators can leverage psexec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. however, it is not likely that you'd see multiple occurrences of this event on a machine	t1021 t1021.002 endpoint splunk
administrators may enable or disable this feature that may cause some false positive.	t1021 t1021.001 t1112 t1219 endpoint splunk
administrators may leverage dcom to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.	t1021 t1021.003 endpoint splunk
administrators may leverage winrm and `enter-pssession` for administrative and troubleshooting tasks. this activity is usually limited to a small set of hosts or users. in certain environments, tuning may not be possible.	t1021 t1021.006 endpoint splunk
administrators may leverage winrm and `invoke-command` to start a process on remote systems for system administration or automation use cases. this activity is usually limited to a small set of hosts or users. in certain environments, tuning may not be possible.	t1021 t1021.006 endpoint splunk
administrators may leverage winrm and winrs to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.	t1021 t1021.006 endpoint splunk
although it is recommended to not have rdp exposed to the internet, verify that this is a) allowed b) the server has not already been compromised via some brute force or remote exploit since it has been exposed to the internet. work to secure the server if you are unable to remove it from being exposed to the internet.	t1021 t1021.001 zeek sigma
although uncommon, administrators may leverage impackets tools to start a process on remote systems for system administration or automation use cases.	t1021 t1021.002 t1021.003 t1047 t1543.003 endpoint splunk
domain controllers acting as printer servers too? :)	t1021 t1021.002 windows sigma
domain controllers that are sometimes, commonly although should not be, acting as printer servers too	t1021 t1021.002 zeek sigma
exploits that were attempted but unsuccessful.	t1021 t1021.006 t1068 t1190 t1203 t1210 zeek sigma
false positives may occur if a user called rundll32 from cli with no options	t1021 t1021.002 t1569 t1569.002 t1570 windows sigma
getsignintoken events will occur when using aws sso portal to login and will generate false positives if you do not filter for the expected user agent(s), see filter. non-sso configured roles would be abnormal and should be investigated.	t1021 t1021.007 t1550 t1550.001 aws sigma
iot (internet of things) devices and networks may use telnet and can be excluded if desired. some business work-flows may use telnet for administration of older devices. these often have a predictable behavior. telnet activity involving an unusual source or destination may be more suspicious. telnet activity involving a production server that has no known associated telnet work-flow or business requirement is often suspicious.	t1021 t1190 network elastic
legitimate activity by administrators and scripts	t1021 t1021.002 windows sigma
legitimate administrator activity	t1021 t1021.002 t1021.004 t1046 t1490 t1505 t1505.004 t1562 t1562.002 t1569 t1569.002 windows macos sigma
legitimate applications may spawn powershell as a child process of the the identified processes. filter as needed.	t1021 t1021.003 t1021.006 t1047 t1053.005 t1059.001 T1218.014 t1543.003 endpoint splunk
legitimate applications may trigger this behavior, filter as needed.	t1021 t1021.003 t1021.006 t1047 t1053 t1053.005 T1218.014 t1543 t1543.003 endpoint splunk
legitimate script	t1018 t1021 t1021.006 t1048 t1059 t1218 t1218.007 t1562 t1562.001 windows sigma
legitimate usage of remote powershell, e.g. for monitoring purposes.	t1021 t1021.006 t1059 t1059.001 windows sigma
legitimate usage of remote powershell, e.g. remote administration and monitoring.	t1021 t1021.006 t1059 t1059.001 windows sigma
legitimate use of aws systems manager to establish a session to an ec2 instance.	t1021 aws elastic
legitimate use remote powershell sessions	t1021 t1021.006 t1059 t1059.001 windows sigma
legitimate user activity.	t1021 t1021.004 t1082 t1098 t1213 t1213.003 t1562 t1562.001 t1591 t1591.004 bitbucket sigma
legitimate user wrong password attempts.	t1021 t1021.004 t1078 t1078.004 t1110 bitbucket sigma
linux hostnames composed of 16 characters.	t1021 t1021.002 windows sigma
network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.	t1021 t1021.001 t1112 endpoint splunk
network service user name of a not-covered localization	t1021 t1021.006 t1059 t1059.001 windows sigma
other programs that cause these patterns (please report)	t1021 windows sigma
possible, different agents with a 8 character binary and a 4, 8 or 16 character service name	t1021 t1021.002 t1569 t1569.002 t1570 windows sigma
powershell remoting is a dual-use protocol that can be used for benign or malicious activity. it's important to baseline your environment to determine the amount of noise to expect from this tool.	t1021 t1059 windows elastic
programs that connect locally to the rdp port	t1021 t1021.001 t1090 t1090.001 t1090.002 windows sigma
psexec is a dual-use tool that can be used for benign or malicious activity. it's important to baseline your environment to determine the amount of noise to expect from this tool.	t1021 t1569 t1570 windows elastic
rdp gateways may have unusually high amounts of traffic from all other hosts' rdp applications in the network.	t1021 t1021.001 endpoint splunk
remote desktop may be used legitimately by users on the network.	t1021 t1021.001 endpoint splunk
scanning attempts with the abnormal use of the http post method with no indication of code execution within the http client (request) body. an example would be vulnerability scanners trying to identify unpatched versions while not actually exploiting the vulnerability. see description for investigation tips.	t1021 t1021.006 t1068 t1190 t1203 t1210 zeek sigma
some administrative tasks on remote host	t1021 t1021.003 t1047 rpc_firewall sigma
some network security policies allow rdp directly from the internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. rdp services may be exposed directly to the internet in some networks such as cloud environments. in such cases, only rdp gateways, bastions or jump servers may be expected expose rdp directly to the internet and can be exempted from this rule. rdp may be required by some work-flows such as remote access and support for specialized software products and servers. such work-flows are usually known and not unexpected.	t1021 t1190 network elastic
some network security policies allow ssh directly from the internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. ssh services may be exposed directly to the internet in some networks such as cloud environments. in such cases, only ssh gateways, bastions or jump servers may be expected expose ssh directly to the internet and can be exempted from this rule. ssh may be required by some work-flows such as remote access and support for specialized software products and servers. such work-flows are usually known and not unexpected.	t1021 t1190 _deprecated elastic
ssh usage may be legitimate depending on the environment. access patterns and follow-on activity should be analyzed to distinguish between authorized and potentially malicious behavior.	t1021 t1133 cloud_defend elastic
system administrators may use looks like psexec for troubleshooting or administrations tasks. however, this will typically come only from certain users and certain systems that can be added to an allow list.	t1021 t1021.002 endpoint splunk
telnet can be used for both benign or malicious purposes. telnet is included by default in some linux distributions, so its presence is not inherently suspicious. the use of telnet to manage devices remotely has declined in recent years in favor of more secure protocols such as ssh. telnet usage by non-automated tools or frameworks may be suspicious.	t1021 linux elastic
third party rdp tools	t1021 t1021.001 windows sigma
this is very uncommon behavior and should result in minimal false positives, ensure validity of the triggered event and include exceptions where necessary.	t1021 t1550 aws elastic
this tool was designed for home usage and not commonly seen in production environment. filter as needed.	t1021 t1021.001 endpoint splunk
trusted openssh executable updates. it's recommended to verify the integrity of openssh binary changes.	t1021 t1543 t1556 t1563 linux elastic
unlikely	t1003 t1003.001 t1003.002 t1003.004 t1003.005 t1003.006 t1005 t1007 t1008 t1012 t1014 t1016 t1018 t1021 t1021.002 t1021.003 t1021.006 t1027 t1027.005 t1033 t1036 t1036.003 t1036.005 t1036.007 t1041 t1046 t1047 t1048 t1048.001 t1053 t1053.003 t1053.005 t1055 t1055.001 t1056 t1057 t1059 t1059.001 t1059.002 t1059.003 t1068 t1070 t1071 t1071.001 t1071.004 t1078 t1082 t1083 t1087 t1090 t1090.001 t1090.003 t1105 t1106 t1112 t1115 t1123 t1127 t1132 t1132.001 t1133 t1134 t1134.001 t1134.002 t1134.004 t1136 t1136.001 t1136.002 t1137 t1137.002 t1140 t1190 t1202 t1203 t1204 t1210 t1213 t1213.003 t1216 t1218 t1218.001 t1218.008 t1218.010 t1218.011 t1218.013 t1219 t1486 t1489 t1490 t1496 t1498 t1499 t1499.001 t1505 t1505.003 t1526 t1528 t1543 t1543.003 t1546 t1546.008 t1546.015 t1548 t1548.003 t1550 t1550.003 t1552 t1552.004 t1553 t1553.004 t1555 t1556 t1557 t1557.001 t1558 t1558.003 t1562 t1562.001 t1562.002 t1562.010 t1564 t1564.004 t1566 t1569 t1569.002 t1570 t1574 t1574.001 t1574.002 t1586 t1587 t1587.001 t1588 t1588.002 t1590 t1590.001 t1590.002 t1620 t1649 windows opencanary okta m365 azure bitbucket macos linux sigma
update the excluded named pipe to filter out any newly observed legit named pipe	t1021 t1021.002 zeek windows sigma
user and network administrator may used this function to add trusted host.	t1021 t1021.006 endpoint splunk
valid user was not added to rdp group	t1021 t1021.001 windows sigma
winrm is a dual-use protocol that can be used for benign or malicious activity. it's important to baseline your environment to determine the amount of noise to expect from this tool.	t1021 windows elastic
wsl (windows sub system for linux)	t1021 t1021.001 windows sigma