| ID | Name |
|---|---|
| T1563.001 | SSH Hijacking |
| T1563.002 | RDP Hijacking |
Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).[1]
Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, c:\windows\system32\tscon.exe [session number to be stolen], an adversary can hijack a session without the need for credentials or prompts to the user.[2] This can be done remotely or locally and with active or disconnected sessions.[3] It can also lead to Remote System Discovery and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.[4]
| ID | Name | Description |
|---|---|---|
| G0001 | Axiom |
Axiom has targeted victims with remote administration tools including RDP.[5] |
| S0366 | WannaCry |
WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session.[6] |
| ID | Mitigation | Description |
|---|---|---|
| M1047 | Audit |
Audit the Remote Desktop Users group membership regularly. Remove unnecessary accounts and groups from Remote Desktop Users groups. |
| M1042 | Disable or Remove Feature or Program |
Disable the RDP service if it is unnecessary. |
| M1035 | Limit Access to Resource Over Network |
Use remote desktop gateways. |
| M1030 | Network Segmentation |
Enable firewall rules to block RDP traffic between network security zones within a network. |
| M1028 | Operating System Configuration |
Change GPOs to define shorter timeouts sessions and maximum amount of time any single session can be active. Change GPOs to specify the maximum amount of time that a disconnected session stays active on the RD session host server.[7] |
| M1026 | Privileged Account Management |
Consider removing the local Administrators group from the list of groups allowed to log in through RDP. |
| M1018 | User Account Management |
Limit remote user permissions if remote access is necessary. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0588 | Detection fo Remote Service Session Hijacking for RDP. | AN1620 |
Detection of suspicious use of |