T1428_exploitation-of-remote-services

T1428 Exploitation of Remote Services

High-Level Description

Adversaries may exploit remote services of enterprise servers, workstations, or other resources to gain unauthorized access to internal systems once inside of a network. Adversaries may exploit remote services by taking advantage of a mobile device’s access to an internal enterprise network through local connectivity or through a Virtual Private Network (VPN). Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

An adversary may need to determine if the remote system is in a vulnerable state, which may be done through Network Service Scanning or other Discovery methods. These look for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.

Depending on the permissions level of the vulnerable remote service, an adversary may achieve Exploitation for Privilege Escalation as a result of lateral movement exploitation as well.

Kill Chain Phase

• Lateral Movement (TA0033)

Platforms: Android, iOS

What to Check

• Identify if Exploitation of Remote Services technique is applicable to target mobile environment
• Check Android devices for indicators of Exploitation of Remote Services
• Check iOS devices for indicators of Exploitation of Remote Services
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Identify Attack Surface

Determine if the target mobile environment is susceptible to Exploitation of Remote Services by examining the target platforms (Android, iOS).

Assess Existing Defenses

Review whether mitigations for T1428 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

Remediation Guide

M1012 Enterprise Policy

Configuration of per-app VPN policies instead of device-wide VPN can restrict access to internal enterprise resource access via VPN to only enterprise-approved applications

Detection

Detection of Exploitation of Remote Services

Risk Assessment

CWE Categories

References

• NIST Mobile Threat Catalogue
• MITRE ATT&CK Mobile - T1428