RDP Hijacking
Subtechnique · ATTACK:enterprise:T1563.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1563.002",
"title": "RDP Hijacking",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1563/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--e0033c16-a07e-48aa-8204-7c3ca669998c",
"external_id": "T1563.002",
"domain": "enterprise",
"created": "2020-02-25T18:35:42.765Z",
"modified": "2025-10-24T17:49:30.049Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"lateral-movement"
],
"source_references": [
{
"source_name": "RDP Hijacking Medium",
"url": "https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6"
},
{
"source_name": "RDP Hijacking Korznikov",
"url": "http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html"
},
{
"source_name": "TechNet Remote Desktop Services",
"url": "https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx"
},
{
"source_name": "Kali Redsnarf",
"url": "https://github.com/nccgroup/redsnarf"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1563.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b6d7542-bf54-4a14-a1e8-55a39c99ce02
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1563.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10be521b-285c-4ce7-a4ec-837b63a0f666
ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1563.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4011ead8-6843-4213-a32e-1edf2c50389a
ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1563.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d0c84c6-1f4b-4adf-924a-7b5489bd0933
Windows RDP SessionsATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1563.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fc1a3c2-dfdb-41d9-97cf-fa6825078bca
ATTACK:enterprise:T1563.002 → subtechnique-of → ATTACK:enterprise:T1563
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68eb092e-fa23-4d6d-8a71-8653e962e7ed
ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1563.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b22c256-44a9-4b73-8df6-e4da9c32a5a3
LogRhythm WannaCryATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1563.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b9e7925-876a-49b1-8b42-e789401f2fad
ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1563.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8aa82bc1-bd38-482d-9cb6-b83877e0b0f4
ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1563.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a78310c3-ee57-465a-9983-13c6a7cd1d4f
Novetta-AxiomATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1563.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6c10d21-5e91-4dfc-b76e-e94d7142ed32