T1563.001 — SSH Hijacking

Tactic: Lateral Movement · Platforms: Linux, macOS

Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password,…

Sub-technique of Remote Service Session Hijacking (T1563).

Sigma detection rules (2)

T1563.001 Remote Service Session Hijacking: SSH Hijacking

title: "T1563.001 Remote Service Session Hijacking: SSH Hijacking"
id: ccdbaeb9-23d4-40ad-837c-ce9fbd63d33a
description: 'Detection Strategy for SSH Session Hijacking. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1563/001
author: Shahrukh Khan
date: 2026-04-19
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1563.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_screen:
    type: EXECVE
    a0|endswith: '/screen'
    a1|contains: '-x'
  selection_tmux:
    type: EXECVE
    a0|endswith: '/tmux'
    a1|contains|all:
      - 'attach'
      - '-t'

  condition: 1 of selection*

falsepositives:
  - Same operator reattaching to their own SSH-multiplexed session from a different terminal; tune UserContext/TimeWindow to require a different auid than the session owner.

level: high

T1563.001 Remote Service Session Hijacking: SSH Hijacking

title: "T1563.001 Remote Service Session Hijacking: SSH Hijacking"
id: ab517a25-93ef-499a-853c-b536a2a1eb76
description: 'Detection Strategy for SSH Session Hijacking. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SocketPathScope, BaselineUsers.'
references:
  - https://attack.mitre.org/techniques/T1563/001
author: Shahrukh Khan
date: 2026-04-16
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1563.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/ssh'
    CommandLine|contains: 'ControlPath'
  filter:
    CommandLine|contains: '/.ssh/sockets/'

  condition: selection and not filter

falsepositives:
  - Standard SSH connection sharing configured in a user ssh config file under a known control socket directory.

level: medium

Related sub-techniques

Explore