CmdID / Techniques
Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. MITRE ATT&CK
T1563 on attack.mitre.org