tfMITRE ATT&CK sub-technique

SSH Hijacking T1563.001

sub-technique of T1563 Remote Service Session Hijacking

Tactic: Lateral Movement
Platforms: Linux, macOS
Version: 1.1
Created: 25 February 2020
Last modified: 24 October 2025
Contributor: Anastasios Pingios

Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

SSH Hijacking MITRE reference T1563.001

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

MEDUSAS1220 ↗

Can be configured to capture SSH credentials via SSH hijacking.1

created 2025-06-09MALWAREcarried by 1 group

All 1 software entries for this technique

Offense vs defense T1563.001

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

SSH Hijacking detection strategy DET0256

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for SSH Session Hijacking

Enterprise

2 platforms

AN0710 · Linux

Suspicious reuse of SSH agent sockets across multiple users or processes, anomalous access to ~/.ssh/ or /tmp/ssh-* sockets, and abnormal patterns of lateral movement via SSH without new authentication events. Defender view: detect when one process accesses another user's SSH agent or when an existing SSH connection is used to pivot unexpectedly.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	Execution of ssh/scp/sftp without corresponding authentication log
Logon Session CreationDC0067	NSM:Connections	Missing new login event but session activity continues
Network Connection CreationDC0082	auditd:SYSCALL	open or connect syscalls on /tmp/ssh-* or $SSH_AUTH_SOCK

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Tune alerts for cross-user access to SSH agent sockets.
TimeWindow	Correlate lack of authentication with lateral SSH activity within a short timeframe.

AN0711 · macOS

Unusual access to SSH agent sockets in /tmp/ or /private/tmp, process access to another user’s $SSH_AUTH_SOCK, and lateral SSH activity without corresponding login events. Defender view: correlation of socket access with anomalous network flows to internal systems.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of ssh or sftp without corresponding login event
Process MetadataDC0034	macos:unifiedlog	Process opening SSH_AUTH_SOCK or /tmp/ssh-* socket not owned by same UID
Logon Session CreationDC0067	macos:unifiedlog	Session reuse without new auth event

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SocketPathScope	Limit detection to monitored SSH agent socket directories.
BaselineUsers	Establish normal SSH agent ownership and expected usage for tuning.

SSH Hijacking detections T1563.001

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs