Live Active security incident? Get immediate response
MITRE ATT&CK® Detection Strategy

DET0256: Detection Strategy for SSH Session Hijacking

This detection strategy matters because SSH session hijacking is a lateral-movement concern: an attacker who has already compromised a host may try to ride...

EnterpriseDET0256Detection StrategyObject v1.0 Modified
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

This detection strategy matters because SSH session hijacking is a lateral-movement concern: an attacker who has already compromised a host may try to ride an existing legitimate SSH trust path instead of creating obvious new access. For leaders, the practical issue is whether the organization can prove which Linux and macOS remote-access sessions are legitimate, where trust relationships exist, and whether the SOC can investigate suspicious SSH use quickly enough to contain spread.

Executive priority

Prioritize this as an operational resilience and incident-response readiness question for environments that depend on SSH for administration, engineering, or production operations. Leaders should ask whether SSH access paths are inventoried, whether privileged remote access is logged sufficiently for investigations, and whether controls distinguish normal administrator behavior from lateral movement. Because the supplied ATT&CK object has no official detection text, decisions should be based on local exposure, SSH dependency, and the related ATT&CK technique T1563.001 SSH Hijacking.

Technical view

The object is a detection strategy, DET0256, for SSH Session Hijacking and is linked to ATT&CK technique T1563.001 under lateral movement. The related technique applies to Linux and macOS. SOC and detection teams should validate visibility into SSH authentication, session activity, user context, source and destination hosts, and administrative access patterns. IR teams should be prepared to correlate a suspected compromised host with subsequent SSH activity to other systems, especially where legitimate trust relationships could allow movement without a new credential prompt.

Likely telemetry

  • SSH authentication and session logs from Linux and macOS systems
  • Source and destination host identifiers for SSH connections
  • User account and privilege context associated with SSH sessions
  • Process and command execution telemetry around SSH client/server activity where available
  • Network connection metadata for SSH traffic

Detection direction

  • Validate that SSH logs are collected centrally from relevant Linux and macOS assets and retained long enough for lateral-movement investigations.
  • Baseline normal SSH administration patterns by user, host pair, time, and role so unusual reuse of legitimate access paths can be reviewed.
  • Correlate suspicious SSH activity with evidence of prior compromise on the source host rather than treating every unusual SSH connection as malicious.
  • Tune detections to reduce false positives from automation, scheduled administration, jump hosts, and approved engineering workflows.
  • Identify blind spots where encrypted SSH traffic is visible only as network metadata and host logs are missing, incomplete, or not mapped to user identity.

Mitigation priorities

  • Inventory SSH-dependent administration paths and trust relationships before prioritizing detection gaps.
  • Ensure Linux and macOS systems that support SSH administration produce usable authentication and session evidence for SOC and IR workflows.
  • Apply least-privilege access and review where trusted SSH access enables broad lateral reach.
  • Strengthen incident playbooks so suspected SSH hijacking triggers source-host containment analysis, destination-host review, and account/session validation.
  • Use compliance and audit readiness activities to confirm that privileged remote access logging and review are demonstrable, not assumed.
Analyst notes and limits

This take is based on the official STIX fields for DET0256 and its relationship to T1563.001 SSH Hijacking. The supplied detection-strategy object does not include an official description, official detection text, platforms, or tactics, so the technical framing is derived from the related ATT&CK technique: lateral movement via SSH session hijacking on Linux and macOS.

The source object is sparse. It does not provide specific analytics, data components, detection logic, mitigations, procedures, adversary use, or platform coverage for the detection strategy itself. Local environment data is required to determine relevance, detection coverage, false-positive patterns, and control priority.

Official MITRE ATT&CK definition

Detection Strategy for SSH Session Hijacking

No official description is available in the imported ATT&CK source object.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1563.001 SSH Hijacking Sub-technique This object detects SSH Hijacking.
Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
07bda2923e729da2...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.0 Current bundle 07bda2923e72…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    mitre-attack DET0256
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.