Remote Service Session Hijacking
Technique · ATTACK:enterprise:T1563
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1563",
"title": "Remote Service Session Hijacking",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1563",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5",
"external_id": "T1563",
"domain": "enterprise",
"created": "2020-02-25T18:26:16.994Z",
"modified": "2025-10-24T17:48:50.118Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"lateral-movement"
],
"source_references": [
{
"source_name": "RDP Hijacking Medium",
"url": "https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6"
},
{
"source_name": "Breach Post-mortem SSH Hijack",
"url": "https://matrix.org/blog/2019/05/08/post-mortem-and-remediations-for-apr-11-security-incident/"
}
]
}Explicit source assertions (7)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:T1563.002 → subtechnique-of → ATTACK:enterprise:T1563
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68eb092e-fa23-4d6d-8a71-8653e962e7ed
ATTACK:enterprise:T1563.001 → subtechnique-of → ATTACK:enterprise:T1563
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f306f1f-bd04-460f-929a-621f458dcd04
ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1563
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--82832161-8d07-45d1-a082-c6958191f16c
ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1563
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c271707-cc73-4cb5-a554-75d74abafac9
ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1563
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ace08873-7afc-42e0-a58f-3d67ee6964b1
ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1563
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1b1a27e-2a62-4c73-9085-c98be89ff7ba
ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1563
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3f593f3-0cea-4795-95a1-7be411c91291