Techniques › T1563 › AN0218
AN0218 Analytic 0218
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of hijacked VNC or SSH sessions on macOS where adversaries take over an existing session rather than authenticating directly. Indicators include process execution from active sessions without new logon events, manipulation of TTY sessions, or anomalous network activity tied to dormant sessions.</p>
- Detects
- T1563 Remote Service Session Hijacking
- Part of
- DET0079 Detection of Remote Service Session Hijacking
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Authentication inconsistencies where commands are executed without corresponding login events | DC0067 Logon Session Creation |
| macos:unifiedlog | Execution of processes linked to hijacked sessions (e.g., anomalous parent-child process lineage) | DC0032 Process Creation |
| NSM:Flow | Suspicious long-lived or reattached remote desktop sessions from unexpected IPs | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
SessionIdleThreshold | Time threshold for inactive sessions flagged as suspicious when commands suddenly resume. |