safemode.space
← MITRE ATT&CK Enterprise
T1021

Remote Services

Description

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).(Citation: SSH Secure Shell)(Citation: TechNet Remote Desktop Services) They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain, or management platforms for internal virtualization environments such as VMware vCenter. Legitimate applications (such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) and other administrative programs) may utilize [Remote Services](https://attack.mitre.org/techniques/T1021) to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protocols, including [VNC](https://attack.mitre.org/techniques/T1021/005) to send the screen and control buffers and [SSH](https://attack.mitre.org/techniques/T1021/004) for secure file transfer.(Citation: Remote Management MDM macOS)(Citation: Kickstart Apple Remote Desktop commands)(Citation: Apple Remote Desktop Admin Guide 3.3) Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement. In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.(Citation: FireEye 2019 Apple Remote Desktop)(Citation: Lockboxx ARD 2019)(Citation: Kickstart Apple Remote Desktop commands)

Mapped SPARTA techniques

4 techniques

  • LM-0003Constellation Hopping via CrosslinkST0007
    addresses
    moderate

    T1021 'Remote Services' is in lateral-movement tactic and addresses lateral movement via legitimate remote-service protocols (RDP, SSH, SMB, etc.); SPARTA LM-0003 covers constellation-hopping via crosslink — using the legitimate inter-satellite-link as the remote service for cross-vehicle lateral movement. Tactic and activity align.

  • LM-0004Visiting Vehicle Interface(s)ST0007
    addresses
    moderate

    Visiting-vehicle interfaces (docking ports, RPO data links, OSAM cooperative interfaces) function as remote services granting lateral access between vehicles — direct instance of T1021 'Remote Services' for cross-vehicle lateral movement. Tactic-aligned.

  • LM-0006Launch Vehicle InterfaceST0007
    addresses
    moderate

    Launch-vehicle-to-spacecraft interfaces (separation connectors, pre-separation data buses, integration ports) are remote services granting cross-vehicle access during the pre-separation phase — direct instance of T1021 'Remote Services' applied to launch-vehicle interfaces.

  • LM-0006.01Rideshare PayloadST0007
    relates to
    high

    Rideshare payload pivoting via the shared launch-vehicle interface or shared upper-stage data bus uses the rideshare-mate's connectivity as a remote service for lateral movement to the target — direct instance of T1021 'Remote Services' applied to rideshare-shared interfaces.

Cross-framework references

Relationships published by the source frameworks themselves, reproduced here with attribution. They are not SafeMode Space mappings and carry no confidence rating of ours.

Countered by 10 in MITRE D3FEND (Defensive Techniques)

Cite as SafeMode Space, mitre-attack-enterprise T1021.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.