MITRE ATT&CK T1210 Exploitation of Remote Services: Detecting and Containing Exploit-Driven Lateral Movement

Once an attacker is inside, one unpatched internal service can turn a single compromised laptop into domain-wide or hypervisor-wide access in minutes, with no stolen password required. MITRE ATT&CK T1210 Exploitation of Remote Services covers adversaries exploiting software vulnerabilities in remote services to gain access to internal systems, most often to move laterally. ATT&CK v20 places it under Lateral Movement (TA0008) on Windows, Linux, macOS and ESXi, maps eight mitigations and one multi-platform detection strategy, DET0118, and records worms, ransomware and espionage groups using it. This guide is the technique view: the recorded cases, the telemetry that shows exploitation rather than administration, the mitigations as concrete settings, and how to test coverage. It is for detection engineers, vulnerability managers and infrastructure teams and contains no exploit detail. For deciding which vulnerabilities to fix first, see the Vulnerability Prioritisation Guide; for lateral movement as a whole, the Lateral Movement Guide.

Key takeaways

• Internal exposure is the attack surface. Internet-facing exploitation is T1190; T1210 is the same class of bug reached from inside, through SMB, RDP, RPC, Netlogon, databases, web services and vCenter or ESXi management interfaces.
• Old bugs still spread. The ATT&CK v20 procedure list is dominated by MS17-010 (EternalBlue, EternalRomance), MS08-067 and Zerologon (CVE-2020-1472); all are in the CISA KEV catalogue, and KEV marks the MS17-010 and Zerologon entries as known ransomware use.
• Exploitation looks like a crash. DET0118 keys on inbound connections to a service followed by that service crashing or restarting, spawning unexpected child processes, or the host opening new outbound internal sessions.
• Removing the service beats patching it. M1042 (disable or remove the feature) and M1030 (segmentation) shrink what can be reached; M1051 and M1016 keep what remains patched and known.
• Machine identities are the prize. Zerologon targets the Netlogon secure channel that computer accounts use, and exploited services often run as privileged service accounts, which is why ATT&CK lists M1026 Privileged Account Management.

What the technique covers

ATT&CK v20 describes T1210 as adversaries exploiting remote services to gain unauthorised access to internal systems once inside a network, by taking advantage of a programming error in a program, service or the operating system to execute adversary-controlled code, with lateral movement as the common goal. The adversary may first check whether a remote system is vulnerable through T1046 Network Service Discovery or other discovery, looking for vulnerable software, missing patches or security software. The entry names well-known vulnerabilities in SMB and RDP, internal applications such as MySQL and web servers, and VMware vCenter vulnerabilities that can let actors move from vCenter to virtual machines or ESXi hypervisors. Depending on the privilege of the exploited service, the result may also be T1068 Exploitation for Privilege Escalation. T1210 has no sub-techniques; the ATT&CK page shows version 1.2, last modified 4 August 2026.

See the T1190 Exploit Public-Facing Application Defensive Guide, T1021 Remote Services and T1068 Exploitation for Privilege Escalation.

How adversaries use it: real cases

The examples below are procedure entries in the ATT&CK v20 data, with the sources ATT&CK cites. KEV status is from the CISA Known Exploited Vulnerabilities catalogue.

Two patterns stand out. First, worm-capable SMB bugs turned ransomware into a network-wide event: WannaCry and NotPetya used SMBv1 exploits to spread to other systems on the network. Microsoft's MS17-010 bulletin, released 14 March 2017 and rated Critical, states that the flaws are in how the SMBv1 server handles certain requests and lists disabling SMBv1 as the workaround. Second, Zerologon converts a foothold into domain control: Dragonfly used CVE-2020-1472 to obtain access to Active Directory servers. ATT&CK v20 also records campaign C0064, an AI-assisted breach of Mexican government infrastructure, in which the adversary tasked an AI coding agent with attempting to exploit EternalBlue: automation lowers the effort of trying old internal exploits against every reachable host. For the AI-agent angle on intrusion operations, see the Anthropic GTG-1002 Campaign 2025 breach analysis.

What to detect and where

ATT&CK v20 detection strategy DET0118 "Exploitation of Remote Services: multi-platform lateral movement detection" has four analytics. The common chain: inbound access to a remote service port, near-time instability in that service (crash, abnormal restart, core dump), unexpected child processes under the service, then new outbound sessions from the same host to other internal assets. The log sources are from DET0118; the tuning notes are NHI Mgmt Group recommendations.

Protocol-specific signals worth collecting

• SMBv1 use: enable SMBv1 access auditing on servers (AuditSmb1Access in the SMB server configuration); each SMBv1 connection attempt logs event 3000 in Microsoft-Windows-SMBServer/Audit. Any SMBv1 traffic in a network that has retired it is a lead.
• Netlogon secure channel: on domain controllers, events 5827 and 5828 record denied vulnerable Netlogon connections from machine and trust accounts, and 5830 and 5831 record vulnerable connections allowed only because the account is on the Group Policy allow list "Domain controller: Allow vulnerable Netlogon secure channel connections". Denials from hosts that are not legacy devices deserve investigation; allow-list entries should trend to zero.
• Internal scanning first: exploitation is usually preceded by T1046 scanning; a workstation connecting to port 445 or 3389 on hundreds of hosts is the earlier and cheaper signal.
• Network detection signatures: IDS rules for known exploit traffic (MS17-010, BlueKeep) on east-west links catch automated spread that endpoint tools on unmanaged hosts miss.

Cutting the noise

1. Baseline crashes: some services crash routinely; alert on a crash only when joined to inbound traffic from an unusual source and a new child process or outbound session within minutes.
2. Scope by asset tier: domain controllers, vCenter, ESXi hosts, backup servers and database servers get the strictest rules and the shortest response time.
3. Exclude scanners by identity: your own vulnerability scanners generate crash-like noise; exclude them by source address and schedule, and alert if a scanner address appears outside its window.

Mitigations as concrete controls

ATT&CK v20 maps eight mitigations to T1210. The table restates each and gives a concrete way to apply it; the settings column is NHI Mgmt Group guidance drawn from vendor documentation where cited.

Zerologon hardening, a worked example

Microsoft's guidance on CVE-2020-1472 shows the pattern for a protocol fix with legacy dependants. Updates released on 11 August 2020 began the initial deployment phase; updates released on 9 February 2021 began the enforcement phase, in which domain controllers enforce secure Netlogon connections regardless of the FullSecureChannelProtection registry value and stop logging event 5829. Non-compliant third-party devices can be allowed temporarily through the "Domain controller: Allow vulnerable Netlogon secure channel connections" Group Policy, which Microsoft warns weakens security and should be emptied once devices are updated. The lesson for any internal service flaw: patch, then audit the exception list until it is empty.

Where identity fits

Remote service exploitation is usually described as a patching problem, but the impact is set by identity. Zerologon abuses the Netlogon secure channel that computer accounts and trust accounts use to authenticate to domain controllers, so a vulnerable DC turns a machine identity mechanism into domain takeover. When a service running as a domain-privileged service account is exploited, the attacker inherits that account's reach. Run internal services under group managed service accounts or low-privilege local accounts, keep service accounts out of Domain Admins, and rotate credentials of any service account on a host found exploited. After a confirmed domain controller compromise, follow Recovering IAM and PAM After Ransomware or Domain Compromise; see also the Group Managed Service Accounts (gMSA) Guide.

Rolling out and choosing priorities

1. Map reachable services: use internal scans and flow data to list which hosts expose SMB, RDP, RPC, WinRM, SSH, database and hypervisor management ports to which networks.
2. Cross with KEV: any reachable service with a KEV-listed CVE is first in the queue, starting with domain controllers, vCenter, ESXi and backup servers.
3. Remove before patching: disable SMBv1, unused spooler and OpenSLP services in audit mode first (SMBv1 access auditing, service usage logs), then switch off.
4. Segment the high-value tier: restrict management interfaces to jump hosts; block workstation to workstation SMB and RDP with host firewalls.
5. Deploy DET0118 analytics: start with domain controllers and hypervisors, tune for two weeks, then extend to server tiers.
6. Roll back: keep firewall changes and feature removals in change records with a tested reversal; for SMBv1, Microsoft notes some legacy systems need it to reach SYSVOL, so test domain controllers last.

Small and large organisations

A small organisation should confirm SMBv1 is off everywhere, patch domain controllers and hypervisors within days of KEV listings, and block inbound SMB and RDP between workstations with the host firewall. A large organisation adds tiered administration, east-west IDS, DET0118 analytics per platform, and an exception register for legacy systems that cannot be patched, each isolated behind its own segment.

How to test your coverage

1. Exposure test: from a standard workstation, run an authorised scan to confirm which management and file-sharing ports on servers it can reach; the answer for DCs and hypervisors should be none.
2. Telemetry test: on an isolated lab copy, trigger a controlled service crash and confirm crash events, child process and flow data reach the SIEM and join in one alert.
3. Purple team: run an authorised exploitation emulation of a patched, non-destructive check against lab systems, and confirm IDS and EDR detections.
4. Audit the exceptions: review the Netlogon allow list and any SMBv1 dependencies quarterly.
5. Record results: update the ATT&CK coverage map and the vulnerability exception register.

Metrics

• KEV exposure: count of internally reachable services with KEV-listed CVEs, and median days to fix.
• Legacy protocol use: SMBv1 audit events (3000) per week, trending to zero.
• Segmentation: share of workstations that cannot reach SMB or RDP on other workstations.
• Tier coverage: share of DCs, vCenter and ESXi hosts sending crash and flow telemetry to the SIEM.
• Exception debt: entries on the Netlogon allow list and unpatchable-system register, with owners and dates.

Common failure patterns

• Patching internet-facing first, internal never: internal servers keep years-old SMB and RPC bugs because they are "not exposed", which is exactly the T1210 gap.
• Flat east-west networks: every workstation can reach every server's port 445, so one exploit spreads like WannaCry and NotPetya did.
• Forgotten appliances and hypervisors: vCenter and ESXi are patched on a different cycle from Windows and drop out of scanning. See the VMware vCenter Server Hardening Guide.
• Permanent exceptions: legacy devices on the Netlogon allow list or with SMBv1 left on for years with no owner.
• Crash logs not collected: application crash events and hostd logs are not forwarded, so the main exploitation signal never reaches the SOC.

Framework mapping

Practitioner checklist

• List every internally reachable SMB, RDP, RPC, WinRM, SSH, database and hypervisor management service by network.
• Fix KEV-listed CVEs on reachable internal services as emergency changes, DCs and hypervisors first.
• Remove SMBv1 and audit for remaining use with event 3000.
• Monitor Netlogon events 5827 to 5831 and drive the allow list to empty.
• Block workstation to workstation SMB and RDP and restrict management interfaces to jump hosts.
• Collect crash, hostd and vmkernel logs and deploy DET0118 chains on the high-value tier.
• Run internal services under low-privilege or managed service accounts.
• Test reachability and detection each quarter with an authorised exercise.

Standards and references

• MITRE ATT&CK: Exploitation of Remote Services (T1210)
• CISA: Known Exploited Vulnerabilities Catalog
• Microsoft: Security Bulletin MS17-010
• Microsoft Support: How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472
• Microsoft Learn: How to detect, enable and disable SMBv1, SMBv2 and SMBv3 in Windows
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: ATT&CK Lateral Movement Tactic · Lateral Movement Guide · SMB Protocol Security and Signing Guide · VMware ESXi Hardening Guide · Emergency Out-of-Band Patching Playbook