T1563.001sub-technique of T1563 Remote Service Session Hijacking
SSH Hijacking
Linux · macOSnothing on this site yetT1563.001 on attack.mitre.org
Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detection Strategy for SSH Session Hijacking
- Suspicious reuse of SSH agent sockets across multiple users or processes, anomalous access to ~/.ssh/ or /tmp/ssh-* sockets, and abnormal patterns of lateral movement via SSH without new authentication events.
- Unusual access to SSH agent sockets in /tmp/ or /private/tmp, process access to another user’s $SSH_AUTH_SOCK, and lateral SSH activity without corresponding login events. Defender view: correlation of socket access with anomalous network flows to internal systems.
what reduces it
- M1027 Password Policies. Ensure SSH key pairs have strong passwords and refrain from using key-store technologies such as ssh-agent unless they are properly protected.
- M1022 Restrict File and Directory Permissions. Ensure proper file permissions are set and harden system to prevent root privilege escalation opportunities.
- M1026 Privileged Account Management. Do not allow remote access via SSH as root or other privileged accounts.
- M1042 Disable or Remove Feature or Program. Ensure that agent forwarding is disabled on systems that do not explicitly require this feature to prevent misuse.