MITRE ATT&CK technique

Remote Service Session Hijacking detection rulesT1563

Remote Service Session Hijacking (T1563) is a MITRE ATT&CK technique in the Lateral Movement tactic. This page lists the 2 community-maintained Sigma detection rules in the library mapped to T1563 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.

T1563 on attack.mitre.org2 rules

Tactic

Lateral Movement

Potential MSTSC Shadowing Activity
high
Detects RDP session hijacking by using MSTSC shadowing
windows · process_creation
Suspicious RDP Redirect Using TSCON
high
Detects a suspicious RDP session redirect using tscon.exe
windows · process_creation

Top products

Tactic

Potential MSTSC Shadowing Activity

Suspicious RDP Redirect Using TSCON