Lateral movement via remote services

Valid credentials over RDP, SMB, SSH, VNC, WinRM, DCOM

Example: RDP in 66% of cases (Sophos)

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1021.001 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1021.001 -TestGuids 01d1c6c0-faf0-408e-b368-752a02285cb2 -TimeoutSeconds 120'

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1021.001 -Tool atomic -RunId run-2026-10-11-001 -Command 'Invoke-AtomicTest T1021.001 -TestGuids 01d1c6c0-faf0-408e-b368-752a02285cb2 -TimeoutSeconds 120'

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1021.001 -Tool atomic -RunId run-2026-10-12-001 -Command 'Invoke-AtomicTest T1021.001 -TestGuids 01d1c6c0-faf0-408e-b368-752a02285cb2 -TimeoutSeconds 120'

Classification

39 values: 12 reviewed, 4 lab-measured, 19 imported, 4 derived. What do these mean?

Exploitability

Impact & scope

Detection & telemetry

Detection & response

Mitigated by 23

• M1018 attack-mitigation
• M1026 attack-mitigation
• M1027 attack-mitigation
• M1028 attack-mitigation
• M1030 attack-mitigation
• M1032 attack-mitigation
• M1033 attack-mitigation
• M1035 attack-mitigation
• M1037 attack-mitigation
• M1042 attack-mitigation
• M1047 attack-mitigation
• M1048 attack-mitigation
• D3-APCA d3fend
• D3-CAA d3fend
• D3-CSPP d3fend
• D3-NTCD d3fend
• D3-NTF d3fend
• D3-NTSA d3fend
• D3-PHDURA d3fend
• D3-PMAD d3fend
• D3-RTSD d3fend
• D3-ST d3fend
• D3-UGLPA d3fend

Detected by 96

• DET0008 attack-detection-strategy
• DET0178 attack-detection-strategy
• DET0211 attack-detection-strategy
• DET0285 attack-detection-strategy
• DET0327 attack-detection-strategy
• DET0477 attack-detection-strategy
• DET0530 attack-detection-strategy
• DET0596 attack-detection-strategy
• 021310d9-30a6-480a-84b7-eaa69aeb92bb sigma
• 055fb54c-a8f4-4aee-bd44-f74cf30a0d9d sigma
• 05a2ab7e-ce11-4b63-86db-ab32e763e11d sigma
• 098d7118-55bc-4912-a836-dc6483a8d150 sigma
• 0d5675be-bc88-4172-86d3-1e96a4476536 sigma
• 10c14723-61c7-4c75-92ca-9af245723ad2 sigma
• 16ab6143-510a-44e2-a615-bdb80b8317fc sigma
• 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac sigma
• 1c563233-030e-4a07-af8c-ee0490a66d3a sigma
• 1fc0809e-06bf-4de3-ad52-25e5263b7623 sigma
• 214e8f95-100a-4e04-bb31-ef6cba8ce07e sigma
• 2f7979ae-f82b-45af-ac1d-2b10e93b0baa sigma
• 2f974656-6d83-4059-bbdf-68ac5403422f sigma
• 327f48c1-a6db-4eb8-875a-f6981f1b0183 sigma
• 32d56ea1-417f-44ff-822b-882873f5f43b sigma
• 3abd6094-7027-475f-9630-8ab9be7b9725 sigma
• 3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781 sigma
• 45545954-4016-43c6-855e-eae8f1c369dc sigma
• 48a61b29-389f-4032-b317-b30de6b95314 sigma
• 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d sigma
• 51e33403-2a37-4d66-a574-1fda1782cc31 sigma
• 52a85084-6989-40c3-8f32-091e12e13f09 sigma
• 52d8b0c6-53d6-439a-9e41-52ad442ad9ad sigma
• 551d9c1f-816c-445b-a7a6-7a3864720d60 sigma
• 586a8d6b-6bfe-4ad9-9d78-888cd2fe50c3 sigma
• 598290cf-5932-45cd-9123-be1e05ab4f2e sigma
• 5a105d34-05fc-401e-8553-272b45c1522d sigma
• 5bb68627-3198-40ca-b458-49f973db8752 sigma
• 5bed80b6-b3e8-428e-a3ae-d3c757589e41 sigma
• 5cdb711b-5740-4fb2-ba88-f7945027afac sigma
• 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4 sigma
• 60167e5c-84b2-4c95-a7ac-86281f27c445 sigma
• … and 56 more in the database

Tested by 18

• 01d1c6c0-faf0-408e-b368-752a02285cb2 atomic
• 0eb03d41-79e4-4393-8e57-6344856be1cf atomic
• 280812c8-4dae-43e9-a74e-1d08ab997c0e atomic
• 2f840dd4-8a2e-4f44-beb3-6b2399ea3771 atomic
• 3386975b-367a-4fbb-9d77-4dcf3639ffd3 atomic
• 355d4632-8cb9-449d-91ce-b566d0253d3e atomic
• 505f24be-1c11-4694-b614-e01ae1cd2570 atomic
• 514e9cd7-9207-4882-98b1-c8f791bae3c5 atomic
• 5295bd61-bd7e-4744-9d52-85962a4cf2d6 atomic
• 6dc74eb1-c9d6-4c53-b3b5-6f50ae339673 atomic
• 74ace21e-a31c-4f7d-b540-53e4eb6d1f73 atomic
• 8a930abe-841c-4d4f-a877-72e9fe90b9ea atomic
• 8f6c14d1-f13d-4616-b7fc-98cc69fe56ec atomic
• 9059e8de-3d7d-4954-a322-46161880b9cf atomic
• d41aaab5-bdfe-431d-a3d5-c29e9136ff46 atomic
• efe86d95-44c4-4509-ae42-7bfd9d1f5b3d atomic
• lab-custom-e2-ssh-evasion-2222 other
• lab-custom-e2-ssh-probe-win other

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

• run-2026-09-30-001 — E2 probe for CANDIDATE rule 100302 (Windows/Sysmon T1021.004: outbound SSH). Connects to a listener on lin-victim 10.10.10.22:22 (its sshd already listens there; if the connect is refused, start custom/e2-sink.py on port 22) so Sysmon EID 3 fires on a real established connection — connect-only, no auth, no payload, closed immediately. Benign. Measures the T1021.004 Windows gap BEFORE 100302 is deployed (expect not-detected / expected-but-silent 100302), then confirms detection after the rule is deployed.; expected=0 incidental=3 max_level=15 dwell_s=90
• run-2026-09-30-002 — E2 probe for CANDIDATE rule 100302 (Windows/Sysmon T1021.004: outbound SSH). Connects to a listener on lin-victim 10.10.10.22:22 (its sshd already listens there; if the connect is refused, start custom/e2-sink.py on port 22) so Sysmon EID 3 fires on a real established connection — connect-only, no auth, no payload, closed immediately. Benign. Measures the T1021.004 Windows gap BEFORE 100302 is deployed (expect not-detected / expected-but-silent 100302), then confirms detection after the rule is deployed.; expected=1 incidental=3 max_level=15 dwell_s=90
• run-2026-09-30-003 — Control-bypass variant of t1021.004-custom-windows-ssh (Phase 8.4). Identical benign SSH connect, but to TCP 2222 instead of 22. Rule 100302 matches destinationPort ^22$ exactly, so moving the port evades it while the lateral-movement behaviour is unchanged — a novel variant, so its detonation is G1 (human-gated). Expect NOT-detected (the evasion succeeds): the detection delta vs the port-22 baseline (run-2026-09-30-002, detected) is measured by agents/evasion.py. Connect to a listener on 10.10.10.22:2222 — start custom/e2-sink.py on 2222 (>1024, no sudo). Benign, connect-only, no auth, no payload.; expected=0 incidental=6 max_level=15 dwell_s=90
• run-2026-10-11-001 — atomic_tests=4 public_sigma_rules=15 caldera=not-indexed; expected=0 incidental=14 max_level=15 dwell_s=90
• run-2026-10-12-001 — atomic_tests=4 public_sigma_rules=15 caldera=not-indexed; expected=0 incidental=14 max_level=15 dwell_s=90
• run-2026-10-12-002 — atomic_tests=4 public_sigma_rules=15 caldera=not-indexed; expected=1 incidental=13 max_level=15 dwell_s=90
• run-2026-10-14-001 — atomic_tests=4 public_sigma_rules=15 caldera=not-indexed; expected=1 incidental=14 max_level=15 dwell_s=90
• run-2026-10-14-010 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=4). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=14 max_level=15 dwell_s=90
• run-2026-10-14-011 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=13 max_level=15 dwell_s=90
• run-2026-10-14-012 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=3). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.006 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=16 max_level=15 dwell_s=90
• run-2026-10-17-002 — atomic_tests=4 public_sigma_rules=15 caldera=not-indexed; expected=1 incidental=1460 max_level=15 dwell_s=90
• run-2026-10-18-003 — atomic_tests=4 public_sigma_rules=15 caldera=not-indexed; expected=1 incidental=1438 max_level=15 dwell_s=90
• run-2026-10-18-013 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=4). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1491 max_level=15 dwell_s=90
• run-2026-10-18-014 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1496 max_level=15 dwell_s=90
• run-2026-10-18-015 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=3). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.006 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1499 max_level=15 dwell_s=90
• run-2026-10-27-005 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=4). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1840 max_level=15 dwell_s=90
• run-2026-10-27-006 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=2). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.003 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=1866 max_level=15 dwell_s=90
• run-2026-10-27-007 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=3). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.006 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1785 max_level=15 dwell_s=90
• run-2026-10-28-007 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=4). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1780 max_level=15 dwell_s=90
• run-2026-10-28-025 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=4). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=1710 max_level=15 dwell_s=90
• run-2026-10-30-004 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=3). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1021.006 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=154 max_level=15 dwell_s=90

Framework references

• Primary source: https://attack.mitre.org/techniques/T1021/
• attack: T1021.001 (primary)
• attack: T1021.002
• attack: T1021.003
• attack: T1021.004
• attack: T1021.005
• attack: T1021.006
• attack: T1021.007
• attack: T1021.008

Evidence & sources

• ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 198 of Cyber-Attack-Taxonomy.md
• ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 10 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
• ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 11 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
• ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 27 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
• ev-0005 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 3 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
• ev-0006 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 5 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
• ev-0007 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 63 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
• ev-0008 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 65 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
• ev-0009 (Phase 4 detection lab - detonation runs 2026-09-30) — Lab detonation run-2026-09-30-001 (partially-detected) for T1021.004: no alert matched the expected technique
• ev-0010 (Phase 4 detection lab - detonation runs 2026-09-30) — Lab detonation run-2026-09-30-002 (detected): Wazuh rule(s) 100302 fired on T1021.004 within the detonation window

  Lateral-movement-adjacent (Windows): outbound SSH connection on TCP 22. ATT&CK T1021.004 (Remote Services: SSH).

• ev-0011 (Phase 4 detection lab - detonation runs 2026-09-30) — Lab detonation run-2026-09-30-003 (partially-detected) for T1021.004: no alert matched the expected technique
• ev-0012 (Phase 4 detection lab - detonation runs 2026-10-11) — Lab detonation run-2026-10-11-001 (partially-detected) for T1021.001: no alert matched the expected technique
• ev-0013 (Phase 4 detection lab - detonation runs 2026-10-12) — Lab detonation run-2026-10-12-001 (partially-detected) for T1021.001: no alert matched the expected technique
• ev-0014 (Phase 4 detection lab - detonation runs 2026-10-12) — Lab detonation run-2026-10-12-002 (detected): Wazuh rule(s) 100213 fired on T1021.001 within the detonation window

  RDP hardening disabled via command line: reg/PowerShell set of RDP-Tcp\UserAuthentication=0 (NLA off) or Terminal Server\fDenyTSConnections=0 (RDP force-enabled) -- enables remote-services lateral movement

• ev-0015 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-001 (detected): Wazuh rule(s) 100213 fired on T1021.001 within the detonation window

  RDP hardening disabled via command line: reg/PowerShell set of RDP-Tcp\UserAuthentication=0 (NLA off) or Terminal Server\fDenyTSConnections=0 (RDP force-enabled) -- enables remote-services lateral movement

• ev-0016 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-010 (partially-detected) for T1021.002: no alert matched the expected technique
• ev-0017 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-011 (partially-detected) for T1021.003: no alert matched the expected technique
• ev-0018 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-012 (partially-detected) for T1021.006: no alert matched the expected technique
• ev-0019 (Phase 4 detection lab - detonation runs 2026-10-17) — Lab detonation run-2026-10-17-002 (detected): Wazuh rule(s) 100213 fired on T1021.001 within the detonation window

  RDP hardening disabled via command line: reg/PowerShell set of RDP-Tcp\UserAuthentication=0 (NLA off) or Terminal Server\fDenyTSConnections=0 (RDP force-enabled) -- enables remote-services lateral movement

• ev-0020 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-003 (detected): Wazuh rule(s) 100213 fired on T1021.001 within the detonation window

  RDP hardening disabled via command line: reg/PowerShell set of RDP-Tcp\UserAuthentication=0 (NLA off) or Terminal Server\fDenyTSConnections=0 (RDP force-enabled) -- enables remote-services lateral movement

• ev-0021 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-013 (partially-detected) for T1021.002: no alert matched the expected technique
• ev-0022 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-014 (partially-detected) for T1021.003: no alert matched the expected technique
• ev-0023 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-015 (partially-detected) for T1021.006: no alert matched the expected technique
• ev-0024 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-005 (partially-detected) for T1021.002: no alert matched the expected technique
• ev-0025 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-006 (detected): Wazuh rule(s) 100406 fired on T1021.003 within the detonation window

  DCOM lateral movement via MMC20.Application: a DCOM-activated mmc.exe (-Embedding) spawned a child process -- T1021.003

• ev-0026 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-007 (partially-detected) for T1021.006: no alert matched the expected technique
• ev-0027 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-007 (partially-detected) for T1021.002: no alert matched the expected technique
• ev-0028 (Phase 4 detection lab - detonation runs 2026-10-28) — Lab detonation run-2026-10-28-025 (detected): Wazuh rule(s) 100426, 100427 fired on T1021.002 within the detonation window

  SMB admin-share mapping via PowerShell New-PSDrive -Root \\host\C$ / ADMIN$ (lateral movement over Windows admin shares) (Security 4688 arm) -- T1021.002

• ev-0029 (Phase 4 detection lab - detonation runs 2026-10-30) — Lab detonation run-2026-10-30-004 (detected): Wazuh rule(s) 100438, 100439 fired on T1021.006 within the detonation window

  WinRM / PowerShell remoting enabled (Enable-PSRemoting, Set-WSManQuickConfig, winrm quickconfig) -- T1021.006