coldbraid

Remote Service Session Hijacking T1563

Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be…

Tactics
Lateral Movement
Actors using it
2
Sub-techniques
1

Ransomware groups reported using it

thegentlemen

Threat actors

MITRE ATT&CKTechnique matrix