CmdID

CmdID / Techniques / T1563

T1563.002 Remote Service Session Hijacking: RDP Hijacking

Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. MITRE ATT&CK

2 Sigma rules T1563.002 on attack.mitre.org

Part of

MITRE ATT&CK
T1563Remote Service Session Hijacking

Sigma rules tagged with it

process creation, the highest levels first
highPotential MSTSC Shadowing ActivityFlorian Roth (Nextron Systems) · Windows
highSuspicious RDP Redirect Using TSCONFlorian Roth (Nextron Systems) · Windows