ATT&CK technique · T1133
External Remote Services
Initial AccessPersistence· seen in 25 CISA KEV exploits
Full description, procedures and detections on attack.mitre.org
Who uses it
ATT&CK groups and malware with this technique. Highlighted: in SecurityTabs news this month.
Weaknesses that lead here
Classes of exploited vulnerability that CTID maps to this technique.
- CWE-775 KEV CVEsImproper Neutralization of Special Elements used in a Command ('Command Injection')Input is pasted into a command without escaping, so attackers append commands of their own.
- CWE-785 KEV CVEsImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Input reaches an operating-system shell, letting an attacker run any command the service can.
- CWE-1192 KEV CVEsImproper Restriction of Operations within the Bounds of a Memory BufferCode reads or writes past the end of a buffer, the root of most classic memory-corruption exploits.
- CWE-1202 KEV CVEsBuffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-1212 KEV CVEsStack-based Buffer OverflowAn overflow on the stack can overwrite the return address and redirect the program to attacker code.
- CWE-1222 KEV CVEsHeap-based Buffer OverflowAn overflow on the heap corrupts neighbouring objects, often turned into code execution.
- CWE-11881 KEV CVEInitialization of a Resource with an Insecure DefaultThe product ships insecure by default, and many installations never change it.
- CWE-13211 KEV CVEImproperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')Input changes the base prototype of JavaScript objects, altering behaviour across the whole application.
Controls that mitigate it (17)
NIST SP 800-53 rev5, grouped by family (CTID mapping).
AC · Access Control
CM · Configuration Management
IA · Identification and Authentication
RA · Risk Assessment
SC · System and Communications Protection
SI · System and Information Integrity
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.