Which SIEM platforms have a T1210 detection rule?

df00tech provides T1210 (Exploitation of Remote Services) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What data sources are required to detect Exploitation of Remote Services (T1210)?

Detecting Exploitation of Remote Services requires the following data sources: Process: Process Creation, Process: OS API Execution, Microsoft Defender for Endpoint DeviceProcessEvents, Microsoft Defender for Endpoint DeviceEvents.

What severity and confidence is the T1210 detection?

The T1210 detection is rated critical severity with medium confidence.

What are common false positives for T1210?

Common false positives for T1210 include: Legitimate print spooler activity during driver installation may spawn msiexec.exe or rundll32.exe (spoolsv.exe -> msiexec.exe with a known printer vendor path); SQL Server maintenance stored procedures or external scripts that invoke cmd.exe for backup/restore operations (sqlservr.exe -> cmd.exe with well-known backup tool paths); IIS application pools running ASP.NET applications that legitimately shell out to cmd.exe for document conversion, PDF generation, or file operations (w3wp.exe -> cmd.exe in specific application pools).

T1210 Splunk · SPL

Detect Exploitation of Remote Services in Splunk

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation occurs when an adversary takes advantage of a programming error in a program, service, or OS kernel to execute adversary-controlled code. Common targets include SMB (EternalBlue/MS17-010 — used by WannaCry, NotPetya, Emotet, QakBot, Bad Rabbit, APT28, Ember Bear), RDP (BlueKeep CVE-2019-0708 — used by InvisiMole, Fox Kitten), Active Directory Netlogon (ZeroLogon CVE-2020-1472 — used by Wizard Spider, Earth Lusca), Windows Print Spooler (PrintNightmare CVE-2021-1675/CVE-2021-34527 — used in ransomware operations), and VMware vCenter (VMSA-2024-0019 — ESXi hypervisor takeover). Post-exploitation typically manifests as unexpected child processes spawned from the exploited service (e.g., spoolsv.exe spawning cmd.exe), remote thread injection into privileged processes, or new services installed via SMB pipes. Successful exploitation may yield SYSTEM-level access, enabling further lateral movement, credential theft, or ransomware deployment.

MITRE ATT&CK

Tactic: Lateral Movement
Technique: T1210 Exploitation of Remote Services
Canonical reference: https://attack.mitre.org/techniques/T1210/

SPL Detection Query

Splunk (SPL)

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=1 OR EventCode=8)
| eval NormalizedParent=coalesce(ParentImage, SourceImage)
| eval NormalizedChild=coalesce(Image, TargetImage)
| eval IsServiceChildExploit=if(
    EventCode=1 AND
    (
      NormalizedParent="*\\spoolsv.exe" OR NormalizedParent="*\\lsass.exe" OR
      NormalizedParent="*\\services.exe" OR NormalizedParent="*\\winlogon.exe" OR
      NormalizedParent="*\\w3wp.exe" OR NormalizedParent="*\\sqlservr.exe" OR
      NormalizedParent="*\\vmtoolsd.exe"
    ) AND
    (
      NormalizedChild="*\\cmd.exe" OR NormalizedChild="*\\powershell.exe" OR
      NormalizedChild="*\\pwsh.exe" OR NormalizedChild="*\\net.exe" OR
      NormalizedChild="*\\net1.exe" OR NormalizedChild="*\\whoami.exe" OR
      NormalizedChild="*\\certutil.exe" OR NormalizedChild="*\\mshta.exe" OR
      NormalizedChild="*\\wscript.exe" OR NormalizedChild="*\\cscript.exe" OR
      NormalizedChild="*\\regsvr32.exe" OR NormalizedChild="*\\rundll32.exe" OR
      NormalizedChild="*\\msiexec.exe"
    ),
    1, 0
)
| eval IsRemoteThreadInject=if(
    EventCode=8 AND
    (
      NormalizedParent="*\\spoolsv.exe" OR NormalizedParent="*\\lsass.exe" OR
      NormalizedParent="*\\services.exe" OR NormalizedParent="*\\w3wp.exe" OR
      NormalizedParent="*\\sqlservr.exe" OR NormalizedParent="*\\vmtoolsd.exe"
    ),
    1, 0
)
| where IsServiceChildExploit=1 OR IsRemoteThreadInject=1
| eval DetectionBranch=if(IsServiceChildExploit=1, "ServiceChildExploit", "RemoteThreadInjection")
| eval ExploitType=case(
    match(NormalizedParent, "spoolsv\.exe"),  "PrintSpooler-PrintNightmare",
    match(NormalizedParent, "lsass\.exe"),    "LSASS-ZeroLogon-Exploitation",
    match(NormalizedParent, "w3wp\.exe"),     "IIS-WebServer-Exploitation",
    match(NormalizedParent, "sqlservr\.exe"), "SQLServer-Exploitation",
    match(NormalizedParent, "vmtoolsd\.exe"), "VMware-Exploitation",
    match(NormalizedParent, "winlogon\.exe"), "AuthService-Exploitation",
    true(), "ServiceProcess-Exploitation"
)
| eval PostExploitIndicators=mvappend(
    if(match(lower(CommandLine), "(whoami|net user|net localgroup|hostname|ipconfig|systeminfo|nltest)"), "SystemRecon", null()),
    if(match(lower(CommandLine), "(-enc|-encodedcommand|bypass|downloadstring|invoke-expression|iex)"), "PowerShellObfuscation", null()),
    if(match(lower(NormalizedChild), "(certutil|mshta|regsvr32|rundll32)\.exe"), "LOLBinExecution", null()),
    if(match(lower(CommandLine), "(net use|copy .*\\\\\\\\|xcopy|robocopy)"), "LateralMovementCmd", null()),
    if(match(lower(CommandLine), "(net user.*\/add|localgroup.*administrators)"), "PrivilegeEscalation", null())
)
| table _time, host, User, NormalizedChild, CommandLine, NormalizedParent, ParentCommandLine, ExploitType, DetectionBranch, PostExploitIndicators
| rename NormalizedChild as ChildProcess, NormalizedParent as ParentProcess
| sort - _time

critical severity medium confidence

Detects post-exploitation activity following remote service exploitation using Sysmon Event ID 1 (Process Creation) and Event ID 8 (CreateRemoteThread). Normalizes ParentImage/SourceImage and Image/TargetImage fields across both event types to enable unified detection. The ExploitType field maps the exploited service to the most likely vulnerability class. The PostExploitIndicators field enriches each alert with specific post-exploitation behaviors observed in the spawned child process command line (reconnaissance commands, LOLBin usage, lateral movement, privilege escalation). Both branches fire as separate detections unified by the where clause.

Data Sources

Process: Process CreationProcess: OS API ExecutionSysmon Event ID 1Sysmon Event ID 8

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives & Tuning

Legitimate print spooler driver installation spawning msiexec.exe or rundll32.exe with known vendor installer paths
SQL Server maintenance jobs invoking cmd.exe for backup utility execution (verify against known backup schedules and paths)
IIS application pools shelling out to cmd.exe for document processing (ASP.NET applications calling pdfconvert, ImageMagick, etc.)
VMware Tools customization scripts invoking PowerShell during VM provisioning or clone finalization

Download portable Sigma rule (.yml)

Other platforms for T1210

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1EternalBlue SMB Vulnerability Scan (MS17-010 Detection)
Expected signal: Sysmon EventID 3 (Network Connection): outbound TCP connections from nmap to <target_lab_ip>:445. On the target Windows host: Security Event ID 5145 (network share access) and potentially IDS/IPS alerts on SMB probe patterns. On the scanning host: no Sysmon events (Linux), but EDR network telemetry shows port 445 probe.
Test 2ZeroLogon Vulnerability Check via Impacket (CVE-2020-1472)
Expected signal: Network connections from testing host to DC on TCP 135 (RPC endpoint mapper) and the dynamically assigned Netlogon RPC port. On the DC: Security Event ID 4742 (Computer Account Changed) if exploitation proceeds, Security Event ID 4625 (Logon Failure) for failed authentication attempts, and Netlogon EventID 5829/5827 (vulnerable Netlogon secure channel connection denied if patch is applied). Windows Defender will generate Alert: Zerologon exploitation attempt if Defender ATP is active.
Test 3PrintNightmare Exploitation via Impacket CVE-2021-1675
Expected signal: On the target host: Sysmon EventID 1 (Process Create) with ParentImage=C:\Windows\System32\spoolsv.exe spawning rundll32.exe or the payload process. Sysmon EventID 7 (Image Load) showing spoolsv.exe loading a DLL from a UNC path (\\attacker\share\nightmare.dll). Security Event ID 316 (Print Spooler: driver installation) in Microsoft-Windows-PrintService/Admin log. File creation event (Sysmon EventID 11) for the DLL written to C:\Windows\System32\spool\drivers\x64\3\.
Test 4BlueKeep RDP Vulnerability Check (CVE-2019-0708)
Expected signal: Sysmon EventID 3 (Network Connection): outbound TCP connections to <target_lab_ip>:3389. On the target: Security Event ID 4625 (Logon Failure) for the authentication probe packets. IDS/IPS alerts for RDP scan signatures. Windows Defender ATP may generate a BlueKeep vulnerability detection alert on the target host based on the probe packet signatures. On the target, Security Event ID 4625 with LogonType=3 and unusual source IP.

Last updated: 2026-04-19 Research depth: deep

References (12)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1210 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Related Detections

Related Techniques

T1046Network Service Discovery T1068Exploitation for Privilege Escalation T1021.002SMB/Windows Admin Shares T1021.001Remote Desktop Protocol T1543.003Windows Service T1003.001LSASS Memory T1105Ingress Tool Transfer T1570Lateral Tool Transfer T1190Exploit Public-Facing Application

Detect Exploitation of Remote Services in Splunk

MITRE ATT&CK

SPL Detection Query

Data Sources

Required Sourcetypes

False Positives & Tuning

Other platforms for T1210

Testing Methodology

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Lateral Movement

Popular Detections

MITRE ATT&CK

SPL Detection Query

Data Sources

Required Sourcetypes

False Positives & Tuning

Other platforms for T1210

Testing Methodology

Unlock Pro Content

Related Detections

Related Techniques

Same Tactic: Lateral Movement

Popular Detections

Get new detections in your inbox