tfMITRE ATT&CK technique
Remote Service Session Hijacking T1563
- Tactic
- Lateral Movement
- Platforms
- Linux, macOS, Windows
- Version
- 1.1
- Created
- 25 February 2020
- Last modified
- 24 October 2025
Sub-techniques 24 rules across the family · 0 mapped directly to T1563 · 1 of 2 carry rules
Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 32% of ATT&CK techniques have none either.