TA0008 · LATERAL MOVEMENT
Remote Service Session Hijacking
Taking over an existing RDP or SSH session that is already authenticated.
Detect it with
tscon.exe use; a session reconnecting from a different source address mid-session.
Why it matters on shift
Remote Service Session Hijacking is one of the concrete ways adversaries achieve lateral movement. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After lateral movement, the next tactic is usually Collection. Search your telemetry for the transition before closing the ticket.
2 sub-techniques
How it shows up in practice
- T1563.001
SSH Hijacking
Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems.
- T1563.002
RDP Hijacking
Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems.
Kill-chain context