Cross-source coverage

T1563 / ATT&CK

Remote Service Session Hijacking

18 rules across 5 sources.

From MITRE ATT&CK 19.2

Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.

Adversaries may commandeer these sessions to carry out actions on remote systems. Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.

Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLNSM:ConnectionsNSM:Flowmacos:unifiedlog

How MITRE says to detect it DET0079

Detection of Remote Service Session Hijacking

Windows Analytic 0216

Detection of anomalous RDP or remote service session activity where a logon session is hijacked rather than newly created. Indicators include mismatched user credentials vs. active session tokens, service session takeovers without corresponding successful logon events, or RDP shadowing activity without user consent.

  • WinEventLog:Security EventCode=4624, 4648
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=3, 22

Linux Analytic 0217

Detection of SSH/Telnet session hijacking via discrepancies between authentication logs and active session tables. Adversary behavior includes reusing or stealing active PTY sessions, attaching to screen/tmux, or issuing commands without corresponding login events.

  • auditd:SYSCALL execve: Commands executed within an SSH session where no matching logon/authentication event exists
  • NSM:Connections Mismatch between recorded user logon and active sessions (e.g., wtmp/utmp entries without corresponding authentication in auth.log)
  • NSM:Flow Long-lived or hijacked SSH sessions maintained with no active user activity

macOS Analytic 0218

Detection of hijacked VNC or SSH sessions on macOS where adversaries take over an existing session rather than authenticating directly. Indicators include process execution from active sessions without new logon events, manipulation of TTY sessions, or anomalous network activity tied to dormant sessions.

  • macos:unifiedlog Authentication inconsistencies where commands are executed without corresponding login events
  • macos:unifiedlog Execution of processes linked to hijacked sessions (e.g., anomalous parent-child process lineage)
  • NSM:Flow Suspicious long-lived or reattached remote desktop sessions from unexpected IPs

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 18 above — a rule tagged a sub-technique covers this technique too.

elastic/detection-rules

9 rules
Detection Severity Format
Potential Remote Desktop Shadowing Activity High Elastic TOML
Potential THC Tool Downloaded High Elastic TOML
Network Connection Initiated by Suspicious SSHD Child Process Medium Elastic TOML
Potential Execution via SSH Backdoor Medium Elastic TOML
SSH Authorized Key File Activity Detected via Defend for Containers Medium Elastic TOML
SSH Authorized Keys File Activity Medium Elastic TOML
Renaming of OpenSSH Binaries Low Elastic TOML
SSH Key Generated via ssh-keygen Low Elastic TOML
Unusual SSHD Child Process Low Elastic TOML

socfortress/Wazuh-Rules

3 rules
Detection Severity Format
Sysmon - Event 1: Process creation · RDP Hijacking Using tscon (T1563.002) High Wazuh XML
Sysmon - Event 1: Process creation · RDP Hijacking via sc.exe Service Creation (T1563.002) High Wazuh XML
Sysmon - Event 1: Process creation · RDP Hijacking via Service Start (T1563.002) High Wazuh XML

SigmaHQ/sigma

2 rules
Detection Severity Format
Potential MSTSC Shadowing Activity High Sigma
Suspicious RDP Redirect Using TSCON High Sigma

elastic/protections-artifacts

2 rules
Detection Severity Format
Potential HackersChoice Tool Downloaded Undefined Elastic TOML
Unusual SSH Parent/Child Execution Undefined Elastic TOML

splunk/security_content

2 rules
Detection Severity Format
Windows RDP Connection Successful Undefined SPL
Windows Service Create with Tscon Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.