Remote Services, Technique T1021 - Enterprise | MITRE ATT&CK®

Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).[1][2] They could also login to accessible SaaS or IaaS services, such as those that federate their identities to the domain. Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts. For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management. ARD leverages a blend of protoco

Remote Services, Technique T1021 - Enterprise | MITRE ATT&CK® ATT&CKcon 7.0 is coming October 27-28, 2026. Learn more about ATT&CKcon 7.0 . Home Techniques Enterprise Remote Services Remote Services Sub-techniques (8) ID Name T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.003 Distributed Component Object Model T1021.004 SSH T1021.005 VNC T1021.006 Windows Remote Management T1021.007 Cloud Services T1021.008 Direct Cloud VM Connections Adversaries may use Valid Accounts to log into a service that accepts remote connections, such as telnet, SSH, and VNC. The adver

related reading

• External Remote Services, Technique T1133 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Valid Accounts, Technique T1078 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Account Manipulation, Technique T1098 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Initial Access, Tactic TA0001 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Persistence, Tactic TA0003 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Assessing Claude Mythos Preview’s cybersecurity capabilities \ Anthropicred.anthropic.com
• Trusted Relationship, Technique T1199 - Enterprise | MITRE ATT&CK®attack.mitre.org
• D3FEND Matrix | MITRE D3FEND™d3fend.mitre.org
• Entra ID service principals in business email compromise schemes | Red Canaryredcanary.com
• When MFA isn’t an option: The legacy of ROPC | Red Canaryredcanary.com
• Log4Shell Security Vulnerability | Orca Research Podorca.security
• Report: Identity Crisis: The Biggest Prize in Security | A Contrary Research Deep Dive | Contrary Researchresearch.contrary.com