Esc
Remote Service Session Hijacking - T1563

(ATT&CK® Technique)
Subtechniques

Definition

Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1563["Remote Service Session Hijacking"] --> |produces| AdministrativeNetworkTraffic["Administrative Network Traffic"]; class T1563 OffensiveTechniqueNode;
        class AdministrativeNetworkTraffic ArtifactNode; click AdministrativeNetworkTraffic href "../../../dao/artifact/d3f:AdministrativeNetworkTraffic";
        click T1563 href "../../../offensive-technique/attack/T1563/"; click AdministrativeNetworkTraffic href "../../../dao/artifact/d3f:AdministrativeNetworkTraffic"; T1563["Remote Service Session Hijacking"] --> |accesses| RemoteSession["Remote Session"]; class T1563 OffensiveTechniqueNode;
        class RemoteSession ArtifactNode; click RemoteSession href "../../../dao/artifact/d3f:RemoteSession";
        click T1563 href "../../../offensive-technique/attack/T1563/"; click RemoteSession href "../../../dao/artifact/d3f:RemoteSession"; T1563["Remote Service Session Hijacking"] --> |accesses| RDPSession["RDP Session"]; class T1563 OffensiveTechniqueNode;
        class RDPSession ArtifactNode; click RDPSession href "../../../dao/artifact/d3f:RDPSession";
        click T1563 href "../../../offensive-technique/attack/T1563/"; click RDPSession href "../../../dao/artifact/d3f:RDPSession"; T1563["Remote Service Session Hijacking"] --> |accesses| SSHSession["SSH Session"]; class T1563 OffensiveTechniqueNode;
        class SSHSession ArtifactNode; click SSHSession href "../../../dao/artifact/d3f:SSHSession";
        click T1563 href "../../../offensive-technique/attack/T1563/"; click SSHSession href "../../../dao/artifact/d3f:SSHSession";                                                    NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          NetworkTrafficCommunityDeviation["Network Traffic Community Deviation"] -.->
            | may-detect | T1563["Remote Service Session Hijacking"] ;
          class NetworkTrafficCommunityDeviation DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click NetworkTrafficCommunityDeviation href "../../../technique/d3f:NetworkTrafficCommunityDeviation"; PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          PerHostDownload-UploadRatioAnalysis["Per Host Download-Upload Ratio Analysis"] -.->
            | may-detect | T1563["Remote Service Session Hijacking"] ;
          class PerHostDownload-UploadRatioAnalysis DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click PerHostDownload-UploadRatioAnalysis href "../../../technique/d3f:PerHostDownload-UploadRatioAnalysis"; ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          ProtocolMetadataAnomalyDetection["Protocol Metadata Anomaly Detection"] -.->
            | may-detect | T1563["Remote Service Session Hijacking"] ;
          class ProtocolMetadataAnomalyDetection DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click ProtocolMetadataAnomalyDetection href "../../../technique/d3f:ProtocolMetadataAnomalyDetection"; RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          RemoteTerminalSessionDetection["Remote Terminal Session Detection"] -.->
            | may-detect | T1563["Remote Service Session Hijacking"] ;
          class RemoteTerminalSessionDetection DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click RemoteTerminalSessionDetection href "../../../technique/d3f:RemoteTerminalSessionDetection";                                                     Client-serverPayloadProfiling["Client-server Payload Profiling"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          Client-serverPayloadProfiling["Client-server Payload Profiling"] -.->
            | may-detect | T1563["Remote Service Session Hijacking"] ;
          class Client-serverPayloadProfiling DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click Client-serverPayloadProfiling href "../../../technique/d3f:Client-serverPayloadProfiling";              NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          NetworkTrafficSignatureAnalysis["Network Traffic Signature Analysis"] -.->
            | may-detect | T1563["Remote Service Session Hijacking"] ;
          class NetworkTrafficSignatureAnalysis DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click NetworkTrafficSignatureAnalysis href "../../../technique/d3f:NetworkTrafficSignatureAnalysis"; NetworkTrafficFiltering["Network Traffic Filtering"] -->
          | filters | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          NetworkTrafficFiltering["Network Traffic Filtering"] -.->
            | may-isolate | T1563["Remote Service Session Hijacking"] ;
          class NetworkTrafficFiltering DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click NetworkTrafficFiltering href "../../../technique/d3f:NetworkTrafficFiltering"; UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -->
          | analyzes | AdministrativeNetworkTraffic["Administrative Network Traffic"];

          UserGeolocationLogonPatternAnalysis["User Geolocation Logon Pattern Analysis"] -.->
            | may-detect | T1563["Remote Service Session Hijacking"] ;
          class UserGeolocationLogonPatternAnalysis DefensiveTechniqueNode;
          class AdministrativeNetworkTraffic ArtifactNode;
          click UserGeolocationLogonPatternAnalysis href "../../../technique/d3f:UserGeolocationLogonPatternAnalysis";                                  SessionTermination["Session Termination"] -->
          | deletes | RemoteSession["Remote Session"];

          SessionTermination["Session Termination"] -.->
            | may-evict | T1563["Remote Service Session Hijacking"] ;
          class SessionTermination DefensiveTechniqueNode;
          class RemoteSession ArtifactNode;
          click SessionTermination href "../../../technique/d3f:SessionTermination"; SessionTermination["Session Termination"] -->
          | deletes | RDPSession["RDP Session"];

          
          class SessionTermination DefensiveTechniqueNode;
          class RDPSession ArtifactNode;
          click SessionTermination href "../../../technique/d3f:SessionTermination"; SessionTermination["Session Termination"] -->
          | deletes | SSHSession["SSH Session"];

          
          class SessionTermination DefensiveTechniqueNode;
          class SSHSession ArtifactNode;
          click SessionTermination href "../../../technique/d3f:SessionTermination";
json