Exploitation of Remote Services

Info

ID:
Tactic: Expanding Control

Exploitation of Remote Services

Adversaries may scan and exploit internal or external service endpoints—such as microservices APIs, container orchestrators, or specialized communication channels—to spread their foothold. Once they find an exposed or vulnerable service, they can compromise it directly using application exploits or stolen credentials. This often serves as a stepping stone to more critical assets.

In practice, these remote services might be unpatched or rely on default credentials that adversaries discovered during reconnaissance. Alternatively, the environment might have insufficient segmentation, letting an attacker pivot from a front‑end microservice to a backend data store. By successfully targeting multiple services, adversaries amplify their control, potentially capturing the entire application stack.