Remote Service Session Hijacking
Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. [Remote Service Session Hijack...
BY SOURCE
PROCEDURES (8)
Auto-extracted: 2 detections for persist
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for child process