AN0216
Analytic 0216
Windows
Detection of anomalous RDP or remote service session activity where a logon session is hijacked rather than newly created. Indicators include mismatched user credentials vs. active session tokens, service session takeovers without corresponding successful logon events, or RDP shadowing activity without user consent.
WinEventLog:Security
EventCode=4624, 4648
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=3, 22
[ExpectedUserSessionMap]
Mapping of users to hosts they are expected to access; deviations indicate possible hijacking.
[TimeWindow]
Threshold for detecting rapid pivoting via hijacked sessions.
AN0217
Analytic 0217
Linux
Detection of SSH/Telnet session hijacking via discrepancies between authentication logs and active session tables. Adversary behavior includes reusing or stealing active PTY sessions, attaching to screen/tmux, or issuing commands without corresponding login events.
auditd:SYSCALL
execve: Commands executed within an SSH session where no matching logon/authentication event exists
NSM:Connections
Mismatch between recorded user logon and active sessions (e.g., wtmp/utmp entries without corresponding authentication in auth.log)
NSM:Flow
Long-lived or hijacked SSH sessions maintained with no active user activity
[MonitoredServicePorts]
Ports for SSH/Telnet/RDP monitored for session hijacking; may vary by environment.
AN0218
Analytic 0218
macOS
Detection of hijacked VNC or SSH sessions on macOS where adversaries take over an existing session rather than authenticating directly. Indicators include process execution from active sessions without new logon events, manipulation of TTY sessions, or anomalous network activity tied to dormant sessions.
macos:unifiedlog
Authentication inconsistencies where commands are executed without corresponding login events
macos:unifiedlog
Execution of processes linked to hijacked sessions (e.g., anomalous parent-child process lineage)
NSM:Flow
Suspicious long-lived or reattached remote desktop sessions from unexpected IPs
[SessionIdleThreshold]
Time threshold for inactive sessions flagged as suspicious when commands suddenly resume.