T1563.002sub-technique of T1563 Remote Service Session Hijacking
RDP Hijacking
Windowsnothing on this site yetT1563.002 on attack.mitre.org
Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detection of Remote Service Session Hijacking for RDP.
- Detection of suspicious use of `tscon.exe` or equivalent methods to hijack legitimate RDP sessions. Defenders can observe anomalies such as session reassignments without corresponding authentication, processes spawned in the context of hijacked sessions, or unusual RDP network traffic flows that deviate from expected...
what reduces it
- M1035 Limit Access to Resource Over Network. Use remote desktop gateways.
- M1028 Operating System Configuration. Change GPOs to define shorter timeouts sessions and maximum amount of time any single session can be active. Change GPOs to specify the maximum amount of time that a disconnected session stays active on the RD session host server.
- M1030 Network Segmentation. Enable firewall rules to block RDP traffic between network security zones within a network.
- M1018 User Account Management. Limit remote user permissions if remote access is necessary.
- M1026 Privileged Account Management. Consider removing the local Administrators group from the list of groups allowed to log in through RDP.
- M1047 Audit. Audit the Remote Desktop Users group membership regularly. Remove unnecessary accounts and groups from Remote Desktop Users groups.