What is remote-service execution?¶
The practical answer¶
Remote-service execution is the use of a network service to cause commands or programs to run on another system.
The key evidential caution¶
The dangerous assumption is that every remote service execution event proves malicious lateral movement.
Administrators and management tools use the same mechanisms.
Possible routes include:
Key points¶
- remote desktop
- remote shell
- service creation
- management protocols
- RMM platforms
- file-sharing services
- cloud administration
- deployment tools
What investigators should establish¶
Investigators should identify:
Key points¶
- the source system
- the target system
- the account used
- the service or protocol
- the command or program
- the time
- the result
- what activity followed
Preserve records on both source and target where possible.
The source may record the connection or command.
The target may record authentication, process creation and resulting changes.
A remote command request may fail.
A service may accept authentication but not execute the command.
Evidential limits¶
Likewise, a command may run under a service account rather than the account used to initiate it.
Do not assume the source IP address identifies the person responsible. The source system may itself be compromised or controlled through another platform.
Where the command is issued through a management platform, preserve the upstream job, operator and approval records. The target may record only a trusted service account even though the originating action came from elsewhere.
This may materially change both technical and personal attribution.
Where command output is available, preserve it as well. It may show whether the remote action succeeded, failed, or was adapted interactively.
Operational takeaway¶
Prove the source, target, account, remote mechanism and resulting execution, and distinguish legitimate management activity from unauthorised movement.