External remote services / edge-device exploitation

Internet-facing VPN, Citrix or firewall gateways exploited for access and persistence

categoryNetwork and infrastructure attacksseverityVery HighdetectabilityHighlabnot yet measured

Example: Ivanti, Fortinet CVEs; BRICKSTORM

Classification

39 values: 16 reviewed, 19 imported, 4 derived. What do these mean?

Exploitability

Attack vector	MisconfigurationNetwork attacksSoftware vulnerabilities
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	Very High
Impact	AvailabilityConfidentialityIntegrity
Platform	ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows
Environment	Edge / IoTHybridOn-premises
Target asset class	Network deviceServer
Kill-chain phase (tactic)	Initial AccessPersistence

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Application Log ContentLogon Session MetadataModule LoadNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess CreationUser Account Authentication

Detection & response

Mitigated by 26

M1016 attack-mitigation
M1021 attack-mitigation
M1026 attack-mitigation
M1030 attack-mitigation
M1032 attack-mitigation
M1035 attack-mitigation
M1037 attack-mitigation
M1042 attack-mitigation
M1048 attack-mitigation
M1050 attack-mitigation
M1051 attack-mitigation
D3-APCA d3fend
D3-CSPP d3fend
D3-DQSA d3fend
D3-ISVA d3fend
D3-ITF d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-PSEP d3fend
D3-RTSD d3fend
D3-SAOR d3fend
D3-ST d3fend
D3-UGLPA d3fend

Detected by 169

DET0080 attack-detection-strategy
DET0354 attack-detection-strategy
043c1609-0e32-4462-a6f2-5a0c2da3fafe sigma
0bbcd74b-0596-41a4-94a0-4e88a76ffdb3 sigma
0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7 sigma
0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a sigma
0e1ebc5a-15d0-4bf6-8199-b2535397433a sigma
0fdc7c7f-c690-4217-9ae3-31f5156eed72 sigma
1012f107-b8f1-4271-af30-5aed2de89b39 sigma
14f3f1c8-02d5-43a2-a191-91ffb52d3015 sigma
15697955-6a29-47ca-92e9-0e05efae3260 sigma
15c312b9-00d0-4feb-8870-7d940a4bdc5e sigma
16c86189-b556-4ee8-b4c7-7e350a195a4f sigma
179ed852-0f9b-4009-93a7-68475910fd86 sigma
181f49fa-0b21-4665-a98c-a57025ebb8c7 sigma
19aa4f58-94ca-45ff-bc34-92e533c0994a sigma
19aefed0-ffd4-47dc-a7fc-f8b1425e84f9 sigma
1a9a04fd-02d1-465c-abad-d733fd409f9c sigma
1b2eeb27-949b-4704-8bfa-d8e5cfa045a1 sigma
1ddaa9a4-eb0b-4398-a9fe-7b018f9e23db sigma
1ddf4596-1908-43c9-add2-1d2c2fcc4797 sigma
1f0489be-b496-4ddf-b3a9-5900f2044e9c sigma
1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d sigma
20c6ed1c-f7f0-4ea3-aa65-4f198e6acb0f sigma
21541900-27a9-4454-9c4c-3f0a4240344a sigma
23eee45e-933b-49f9-ae1b-df706d2d52ef sigma
245f92e3-c4da-45f1-9070-bc552e06db11 sigma
259a9cdf-c4dd-4fa2-b243-2269e5ab18a2 sigma
271de298-cc0e-4842-acd8-079a0a99ea65 sigma
27d2cdde-9778-490e-91ec-9bd0be6e8cc6 sigma
2bfb6216-0c31-4d20-8501-2629b29a3fa2 sigma
2dbc10d7-a797-49a8-8776-49efa6442e60 sigma
3007fec6-e761-4319-91af-e32e20ac43f5 sigma
31e4e649-7394-4fd2-9ae7-dbc61eebb550 sigma
377f33a1-4b36-4ee1-acee-1dbe4b43cfbe sigma
37e8369b-43bb-4bf8-83b6-6dd43bda2000 sigma
38825179-3c78-4fed-b222-2e2166b926b1 sigma
3eb91f0a-0060-424a-a676-59f5fdd75610 sigma
412d55bc-7737-4d25-9542-5b396867ce55 sigma
41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe sigma
… and 129 more in the database

Tested by 1

4c8db261-a58b-42a6-a866-0a294deedde4 atomic

Framework references

Primary source: https://attack.mitre.org/techniques/T1133/
attack: T1133 (primary)
attack: T1190

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 203 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 43 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 75 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)