MITRE ATT&CK T1563 Remote Service Session Hijacking: Detecting and Containing Lateral Movement

Session hijacking lets an attacker move laterally on a session someone else already authenticated, so the login controls you invested in never get a chance to fire. MITRE ATT&CK tracks this as T1563 Remote Service Session Hijacking, in the Lateral Movement tactic, with two sub-techniques: T1563.001 SSH Hijacking and T1563.002 RDP Hijacking. ATT&CK separates it from T1021 Remote Services on one point: the adversary takes over an existing session instead of creating a new one with valid accounts. That difference changes what you can detect, because the tell-tale logon event is missing. This guide is for SOC analysts, detection engineers and Windows and Linux platform owners. It covers how both variants work at a defensive level, the telemetry that exposes them, the configuration that removes the opportunity, and how to contain a hijacked session. For new-session lateral movement over RDP and SSH, see T1021 Remote Services; for the wider picture, see the Lateral Movement Guide.

Key takeaways

• The precondition is local privilege plus a live session. RDP hijacking needs SYSTEM on a host with an active or disconnected session; SSH hijacking needs access to another user's agent socket or control socket, which root has by default.
• No new authentication means no logon event to alert on. Detection rests on mismatches: a session reconnect (event 4778) without a matching interactive logon, or SSH traffic that has no new authentication record.
• Disconnected sessions are the RDP attack surface. Windows keeps disconnected sessions alive indefinitely unless the "Set time limit for disconnected sessions" policy is set, and an idle admin session is the best prize on a server.
• Agent forwarding is the SSH attack surface. The OpenSSH manual warns that anyone who can bypass file permissions on the remote agent socket can use the forwarded keys. Prefer ProxyJump, and constrain keys with ssh-add -h where forwarding is unavoidable.
• Containment is session-first. Log off the hijacked session, not just the attacker's process, then treat the victim's identity as exposed and work out which hosts its session could reach.

How the technique works

ATT&CK describes T1563 as commandeering preexisting sessions with services designed for remote connections, such as telnet, SSH and RDP, to carry out actions on remote systems. The two sub-techniques share a pattern: the attacker already controls a host, a more privileged user has a session on or through that host, and the attacker attaches to that session instead of stealing a password.

T1563.002 RDP Hijacking

On a Windows host that accepts Remote Desktop, each user session has an ID. ATT&CK notes that with SYSTEM permissions an adversary can use the built-in Terminal Services Console binary, tscon.exe, to attach to another user's session without credentials or a prompt to that user, against active or disconnected sessions, locally or remotely. Microsoft's tscon documentation explains why SYSTEM matters: connecting to another user's session normally needs Full Control or Connect special access and the owner's password, and the command fails without one. The prize is whatever the victim had open, including a domain admin's console, management tools already authenticated to other systems and cached tokens in the session.

T1563.001 SSH Hijacking

ATT&CK describes SSH hijacking as abusing trust relationships in active SSH sessions, through compromising ssh-agent or gaining access to the agent's socket, and notes that with root access this is "likely trivial". Two mechanisms dominate:

• Forwarded agent socket: when a user connects with ForwardAgent enabled, the remote host exposes a socket that relays signing requests to the user's local agent. The OpenSSH ssh_config manual states that users who can bypass file permissions on that socket can access the local agent through the forwarded connection. They cannot extract the private keys, but they can authenticate as the user to anything those keys open.
• Multiplexed control socket: ControlMaster lets several sessions share one authenticated connection through a socket named by ControlPath. Anyone able to use that socket can open new channels on an already authenticated connection. ControlPersist keeps it alive after the user's last session ends.

Terminal multiplexers (screen, tmux) and stolen pseudo-terminals are a third path, and ATT&CK's Linux analytic for T1563 lists attaching to screen or tmux and issuing commands without corresponding login events.

Where it shows up

Ransomware operators use session takeover alongside credential theft once they hold SYSTEM on a server; see the LockBit Threat Actor Profile for how affiliates move from one foothold to domain-wide control.

Detection

ATT&CK v20 ships three detection strategies for this technique: one for the parent (with Windows, Linux and macOS analytics), one for RDP and one for SSH. All of them look for the same thing from different angles: activity in a session that has no matching fresh authentication.

Microsoft's monitoring guidance for event 4778 is a good starting baseline: watch high-value accounts, flag any Client Address outside known ranges, and alert on RDP session names on hosts where Remote Desktop should be off. Event 4778 and 4779 are only written when the Audit Other Logon/Logoff Events subcategory is enabled, so confirm it in your audit policy before you rely on them.

Measuring detection

• Coverage: percentage of RDP-enabled servers sending events 4778, 4779 and 4688 with command line to the SIEM.
• Exposure: count of disconnected sessions older than your time limit, per server, sampled daily.
• Privileged exposure: number of Tier 0 accounts with sessions on non-Tier 0 hosts.
• Forwarding footprint: share of SSH logons to bastions that request agent forwarding.
• Validation: time from a purple-team session takeover to an alert, tested quarterly.

Prevention and hardening

Windows and RDP

1. Limit disconnected sessions. Configure Set time limit for disconnected sessions under Administrative Templates, Windows Components, Remote Desktop Services, Remote Desktop Session Host, Session Time Limits. Microsoft documents that disconnected sessions are deleted after the limit and that "Never" keeps the default unlimited behaviour. Pair it with the idle and active session limits and Terminate sessions when time limits are reached, so idle sessions are logged off rather than disconnected. ATT&CK lists this GPO approach as mitigation M1028.
2. Keep privileged identities off lower tiers. A domain admin session on a member server is the target. Use the enterprise access model in the Tiered Administration and Enterprise Access Model Guide and administer from Privileged Access Workstations.
3. Use Restricted Admin or Remote Credential Guard. The policy Restrict delegation of credentials to remote servers (System, Credentials Delegation) can require either. Microsoft documents that with Remote Credential Guard an attacker on the host can act as the user only while the session is ongoing, and that both modes prevent use of credentials after disconnection. They reduce what a hijacked session yields; they do not stop the hijack itself.
4. Remove SYSTEM paths. RDP hijacking needs SYSTEM, so local admin sprawl is the real enabler. Rotate local admin passwords with LAPS, restrict who can create services, and audit the Remote Desktop Users group (M1047).
5. Route RDP through a gateway. ATT&CK lists RD gateways (M1035) and segmentation (M1030). Disable RDP where it is not needed (M1042).

Linux, macOS and SSH

1. Replace agent forwarding with ProxyJump. ProxyJump tunnels the connection through a bastion so the agent never sits on it. Set ForwardAgent no as the client default and disable forwarding on bastions with DisableForwarding or AllowAgentForwarding no. The sshd_config manual notes that disabling agent forwarding alone adds little unless users are also denied shell access, because they can install their own forwarders.
2. Constrain keys you must forward. OpenSSH 8.9 and later support destination constraints with ssh-add -h, plus -c to require confirmation of each use and -t to set a lifetime. The ssh-add manual is explicit that constraints do not stop an attacker with the remote socket from forwarding the key again, only limit where it can be used.
3. Protect control sockets. Keep ControlPath in a directory other users cannot write to, include %C or %h, %p and %r as the manual recommends, and keep ControlPersist short on shared hosts.
4. Close idle sessions. Use ChannelTimeout and UnusedConnectionTimeout on servers so abandoned sessions and channels do not linger.
5. Deny remote root. Set PermitRootLogin no and guard root on bastions (M1026), because root reads every socket on the host.

Short-lived SSH certificates shrink the window further; see the SSH Protocol and Certificate Authority Guide and the SSH Key Management Guide.

Choosing controls: what to do first

Our recommendation at NHI Mgmt Group: start with a 15 minute to 1 hour disconnected-session limit on servers, tune it per role, and use the shortest values on Tier 0 hosts.

Containing a hijacked session

1. Preserve first, quickly: capture the session list, process tree, recent 4778, 4779, 4624 and 4688 events or auth and audit logs, and the agent and control socket paths before changes.
2. End the session itself: log off the hijacked Windows session or kill the SSH master connection and remove the socket, so the attacker cannot reattach.
3. Isolate the host where the attacker held SYSTEM or root: that host is the real foothold, and session hijacking is the symptom.
4. Treat the victim's identity as exposed: list every system the session or forwarded keys could reach while hijacked, reset or revoke credentials, rotate keys the agent held, and review those systems for new accounts and persistence. The SSH Key Compromise Response Playbook covers key rotation in detail.
5. Close the gap: apply the session limits and forwarding changes above on the affected host class before returning it to service.

Where identity fits

Session hijacking turns a host compromise into an identity compromise without touching a password store. The identities most at risk are privileged human admins with long-lived sessions and non-human identities whose keys sit in agents on build hosts and automation servers, often with broad production reach and nobody watching their sessions. Inventory which service accounts and deploy keys hold persistent sessions or loaded agents, give them per-job credentials, and alert when their keys are used from hosts outside their pipeline. See MITRE ATT&CK T1078 Valid Accounts Guide and MITRE ATT&CK T1550 Use Alternate Authentication Material Guide for the neighbouring techniques.

Framework mapping

Common failure patterns

• Treating logon alerts as full coverage: hijacking produces a reconnect, not a logon, so rules that only watch event 4624 miss it.
• "Other Logon/Logoff Events" not audited: without that subcategory there are no 4778 or 4779 events to correlate.
• Unlimited disconnected sessions on jump servers: the default leaves admin sessions waiting for days.
• Agent forwarding to shared bastions: every root user on the bastion can sign with every visiting engineer's keys.
• Closing the attacker's process but not the session: the session survives and the attacker reattaches from the same SYSTEM foothold.
• Not scoping the victim's reach: responders fix the host and forget the systems the hijacked session touched.

Practitioner checklist

• Set disconnected, idle and active session limits by GPO on every RDP-enabled server, and terminate rather than disconnect.
• Enable Audit Other Logon/Logoff Events and command-line process auditing, and ship 4778, 4779 and 4688 to the SIEM.
• Alert on tscon.exe running as SYSTEM and on reconnects with no matching logon.
• Require Restricted Admin or Remote Credential Guard for admin RDP.
• Keep Tier 0 accounts off lower-tier hosts and administer from PAWs.
• Set ForwardAgent no by default, use ProxyJump, and disable forwarding on bastions.
• Use ssh-add -h, -c and -t for any key that must be forwarded.
• Protect ControlPath directories and keep ControlPersist short on shared hosts.
• Give CI and automation identities per-job keys instead of persistent agents.
• Rehearse session-hijack containment in a purple-team exercise each quarter.

Standards and references

• MITRE ATT&CK: T1563 Remote Service Session Hijacking
• MITRE ATT&CK: T1563.002 RDP Hijacking
• MITRE ATT&CK: T1563.001 SSH Hijacking
• Microsoft Learn: Event 4778 A session was reconnected to a Window Station
• Microsoft Learn: tscon
• Microsoft Learn: Remote Credential Guard
• Microsoft Learn: Session Time Limits
• OpenBSD: ssh_config(5) manual

Related NHI Mgmt Group resources: Remote Desktop (RDP) Security Guide · Exposed RDP Compromise · Lateral Movement Guide · SSH Key Management Guide