DET0354: Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
MITRE ATT&CK DET0354: Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers Detection Strategy details, with…
Security context for executives and security teams
DET0354 is a detection strategy linked to ATT&CK technique T1133, External Remote Services. The business issue is not simply “remote access exists”; it is that VPNs, Citrix-like gateways, and other externally reachable access services can become paths for initial access or persistence if identity, access logging, and SOC correlation are weak. For leaders, this behavior matters because remote access is usually business-critical, highly privileged in practice, and often exposed to the internet.
Executive priority
Prioritize this as a resilience and identity-control validation topic. Executives and risk owners should ask whether external remote access is inventoried, strongly authenticated, monitored, and reviewable during an incident. Because the related ATT&CK technique spans initial access and persistence, coverage should not be treated as a single perimeter alert; it should be evidenced through identity logs, remote access gateway records, endpoint activity, and incident response playbooks that can distinguish normal workforce access from suspicious behavior chains.
Technical view
MITRE provides the detection strategy name and its relationship to T1133, but no official description or detection logic. SOC and detection teams should therefore validate behavior-chain coverage around external remote services rather than relying on one event type. Practical validation should include remote access authentication, session establishment, source location or network context, account behavior, endpoint follow-on activity, and persistence-oriented reuse of access. The related technique applies to enterprise environments involving Windows, Linux, macOS, and Containers, so teams should confirm whether telemetry exists across the actual remote access paths and downstream assets in scope.
Likely telemetry
- VPN, remote access gateway, Citrix-like access service, or externally facing remote service authentication logs
- Identity provider and MFA logs tied to external remote service access
- Network connection and session metadata for inbound remote access
- Endpoint logs on Windows, Linux, and macOS systems reached after remote access
- Container or container platform access records where external remote services lead into containerized environments
Detection direction
- Build or validate correlation across authentication, remote session creation, source network context, and post-login endpoint activity instead of depending on a single failed-login or success-login rule.
- Tune for expected remote workforce behavior, service accounts, administrators, third-party access, and geographically distributed users to reduce false positives while preserving suspicious behavior-chain visibility.
- Confirm logging coverage for all externally reachable remote access mechanisms, not only the primary VPN or identity provider.
- Validate that detections can support both ATT&CK tactics associated with T1133: initial access and persistence.
- Look for blind spots where remote access gateways authenticate users but downstream endpoint or workload activity is not correlated back to the originating session.
Mitigation priorities
- Inventory externally reachable remote access services and map them to owners, authentication sources, and logging sources.
- Prioritize strong identity controls, access review, and MFA enforcement for remote access paths where supported by the environment.
- Ensure remote access logs are retained, normalized, and available to SOC and incident response teams.
- Correlate identity, gateway, network, and endpoint telemetry so investigations can reconstruct remote access behavior chains.
- Review privileged and third-party remote access separately because misuse can have higher operational impact.
Additional notes and limits
The strongest supported context is the relationship to T1133 External Remote Services, which MITRE associates with persistence and initial access and platforms including Containers, Linux, macOS, and Windows. The supplied DET0354 object itself has no official description, no official detection text, and no explicit tactics or platforms, so this take focuses on defensible validation questions and telemetry classes rather than specific analytics.
This summary uses only the supplied STIX fields, external reference, and relationship context. It does not assert active exploitation, adversary attribution, guaranteed detection coverage, or vendor-specific controls. Local architecture, identity design, remote access technologies, and log availability are required to determine actual coverage and risk.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Behavior-chain detection for T1133 External Remote Services across Windows, Linux, macOS, Containers
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1133 | External Remote Services | This object detects External Remote Services. |
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 6b465cb9b658… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]mitre-attackDET0354Open source URL
- [2]mitre-attackDET0354Open source URL
- [3]mitre-attackDET0354Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.