Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.
Adversaries may commandeer these sessions to carry out actions on remote systems. Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.(Citation: RDP Hijacking Medium)(Citation: Breach Post-mortem SSH Hijack)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-12.8 | Establish and Maintain Dedicated Computing Resources for All Administrative Work | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Adversaries hijack existing SSH, RDP, or other remote-management sessions. Keeping administrative sessions on dedicated, segmented resources reduces exposure of those sessions to compromised user endpoints and limits unnecessary network paths to privileged remote services.
References
|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Using role-based access control (RBAC) to limit remote user permissions to necessary users to help prevent adversaries from commandeering these sessions.
References
|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Disabling unnecessary remote services prevents sessions from being established through those services and therefore removes sessions that could later be hijacked.
References
|
| CIS-4.6 | Securely Manage Enterprise Assets and Software | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Securely configuring remote services can reduce unnecessary sessions and restrict features that facilitate hijacking. Encryption does not prevent an adversary already executing on a system from taking control of an existing session.
References
|
| CIS-4.5 | Implement and Manage a Firewall on End-User Devices | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Blocking unnecessary remote-service connectivity reduces the opportunity to reach a session that could be hijacked.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1563 | Remote Service Session Hijacking |
Comments
Restricting remote-service traffic between production and non-production security zones reduces the ability of an adversary in one environment to reach and hijack remote sessions in the other.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.malware.variety.Disable controls | Disable or interfere with security controls | related-to | T1563 | Remote Service Session Hijacking | |
| action.hacking.variety.Abuse of functionality | Abuse of functionality. | related-to | T1563 | Remote Service Session Hijacking | |
| action.hacking.variety.Hijack | To assume control over and steal functionality for an illicit purpose (e.g. Hijacking phone number intercept SMS verification codes) | related-to | T1563 | Remote Service Session Hijacking | |
| action.malware.vector.Network propagation | Network propagation | related-to | T1563 | Remote Service Session Hijacking |
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1563.001 | SSH Hijacking | 7 |
| T1563.002 | RDP Hijacking | 13 |