value: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.
  
  Adversaries may commandeer these sessions to carry out actions on remote systems. [Remote Service Session Hijacking](T1563) differs from use of [Remote Services](T1021) because it hijacks an existing session rather than creating a new session using [Valid Accounts](T1078).(Citation: RDP Hijacking Medium)(Citation: Breach Post-mortem SSH Hijack)
name: Remote Service Session Hijacking