T1563.002: RDP Hijacking
Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).[1]
Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\windows\system32\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user.[2] This can be done remotely or locally and with active or disconnected sessions.[3] It can also lead to Remote System Discovery and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.[4]
Analyst context for executives and security teams
RDP Hijacking matters because it can turn a legitimate Windows remote desktop session into a lateral movement path. The business risk is not only stolen credentials; an attacker with sufficient local or remote privileges may take over an existing active or disconnected RDP session, potentially inheriting access from a more privileged user without prompting that user.
Executive priority
Prioritize this where RDP/RDS is used for administration, support, jump hosts, or access to sensitive Windows systems. Leaders should ask whether privileged sessions are limited, audited, and segmented, and whether incident responders can quickly determine who used an RDP session versus who originally authenticated. This technique is especially relevant to privileged access management, remote access governance, lateral movement containment, and audit evidence for administrative activity.
Technical view
This is a Windows lateral movement sub-technique under Remote Service Session Hijacking. MITRE does not provide technique-specific detection text, but a related detection strategy, DET0588, is linked for remote service session hijacking over RDP. SOC and IR teams should validate visibility into RDP/RDS session creation, reconnection, disconnection, session ownership changes, privileged process execution, and use of native Windows terminal services utilities such as tscon.exe. Investigations should distinguish normal administrator session management from unexpected takeover of another user’s session, especially where SYSTEM-level or privileged accounts are involved.
Likely telemetry
- Windows security and terminal services event logs for RDP logon, reconnect, disconnect, and session activity
- Process execution telemetry on Windows hosts, especially terminal services utilities and privileged command execution
- Privileged account activity logs, including administrative and SYSTEM-context actions
- RDP/RDS gateway, jump host, or remote access logs where used
- Endpoint detection and response telemetry for interactive logon context changes
Detection direction
- Validate whether DET0588 or equivalent analytics are implemented and whether they cover Windows systems using RDP/RDS.
- Correlate RDP session events with process execution and user context to identify session takeover patterns rather than only successful logons.
- Tune detections around administrative support workflows to reduce false positives while preserving alerts for cross-user session control, privileged sessions, and unusual source systems.
- Look for blind spots on jump hosts, servers with disconnected privileged sessions, systems lacking terminal services logging, and environments where RDP is allowed broadly between internal segments.
- Use relationship context carefully: ATT&CK links this technique to Axiom and WannaCry, but that should inform threat-informed testing and hunting, not assumptions of attribution or current exposure.
Mitigation priorities
- Start with user account management and least privilege so ordinary accounts cannot unnecessarily control or access remote sessions.
- Strengthen privileged account management: limit privileged RDP use, reduce standing admin rights, and monitor privileged interactive sessions.
- Harden operating system and RDP/RDS configuration, and disable or remove remote desktop capabilities where there is no business requirement.
- Limit access to RDP over the network using approved remote access paths, gateways, or equivalent controls, and restrict which users and systems may connect.
- Apply network segmentation to reduce lateral movement paths between workstations, servers, and administrative systems.
Analyst notes and limits
MITRE identifies this as ATT&CK T1563.002, RDP Hijacking, a Windows lateral movement sub-technique. The official description highlights that native Windows functionality can be abused to take over legitimate RDP sessions, including active or disconnected sessions, and that privileged sessions may create escalation opportunities. The supplied relationships identify mitigations M1018, M1026, M1028, M1030, M1035, M1042, and M1047, plus a related detection strategy DET0588.
The official ATT&CK detection field is not provided, so detection guidance here is derived from the technique description and supplied relationships rather than MITRE-authored detection text. Local validation is required to confirm whether RDP is enabled, where RDS is used, what logs are collected, and which administrative workflows may resemble suspicious session control.
RDP Hijacking
Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).[1]
Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\windows\system32\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user.[2] This can be done remotely or locally and with active or disconnected sessions.[3] It can also lead to Remote System Discovery and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.[4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1563 | Remote Service Session Hijacking | This object subtechnique of Remote Service Session Hijacking. |
Groups, software, and campaigns
G0001: Axiom
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.[1][2][3]
S0366: WannaCry
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 5579088fc241… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
TechNet Remote Desktop Services
Microsoft. (n.d.). Remote Desktop Services. Retrieved June 1, 2016.
Open source URL -
[2]
RDP Hijacking Korznikov
Korznikov, A. (2017, March 17). Passwordless RDP Session Hijacking Feature All Windows versions. Retrieved December 11, 2017.
Open source URL -
[3]
RDP Hijacking Medium
Beaumont, K. (2017, March 19). RDP hijacking — how to hijack RDS and RemoteApp sessions transparently to move through an organisation. Retrieved December 11, 2017.
Open source URL -
[4]
Kali Redsnarf
NCC Group PLC. (2016, November 1). Kali Redsnarf. Retrieved December 11, 2017.
Open source URL -
[5]
mitre-attack T1563.002Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.