{'created': '2020-02-25T18:34:38.290Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': "Adversaries may hijack a legitimate user's SSH session to "
                'move laterally within an environment. Secure Shell (SSH) is a '
                'standard means of remote access on Linux and macOS systems. '
                'It allows a user to connect to another system via an '
                'encrypted tunnel, commonly authenticating through a password, '
                'certificate or the use of an asymmetric encryption key pair.\n'
                '\n'
                'In order to move laterally from a compromised host, '
                'adversaries may take advantage of trust relationships '
                'established with other systems via public key authentication '
                'in active SSH sessions by hijacking an existing connection to '
                'another system. This may occur through compromising the SSH '
                "agent itself or by having access to the agent's socket. If an "
                'adversary is able to obtain root access, then hijacking SSH '
                'sessions is likely trivial.(Citation: Slideshare Abusing '
                'SSH)(Citation: SSHjack Blackhat)(Citation: Clockwork SSH '
                'Agent Hijacking)(Citation: Breach Post-mortem SSH Hijack)\n'
                '\n'
                '[SSH '
                'Hijacking](https://attack.mitre.org/techniques/T1563/001) '
                'differs from use of '
                '[SSH](https://attack.mitre.org/techniques/T1021/004) because '
                'it hijacks an existing SSH session rather than creating a new '
                'session using [Valid '
                'Accounts](https://attack.mitre.org/techniques/T1078).',
 'external_references': [{'external_id': 'T1563.001',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1563/001'},
                         {'description': 'Adam Boileau. (2005, August 5). '
                                         'Trust Transience:  Post Intrusion '
                                         'SSH Hijacking. Retrieved December '
                                         '19, 2017.',
                          'source_name': 'SSHjack Blackhat',
                          'url': 'https://www.blackhat.com/presentations/bh-usa-05/bh-us-05-boileau.pdf'},
                         {'description': 'Beuchler, B. (2012, September 28). '
                                         'SSH Agent Hijacking. Retrieved '
                                         'November 17, 2024.',
                          'source_name': 'Clockwork SSH Agent Hijacking',
                          'url': 'https://web.archive.org/web/20210311184303/https://www.clockwork.com/news/2012/09/28/602/ssh_agent_hijacking/'},
                         {'description': 'Duarte, H., Morrison, B. (2012). '
                                         '(Mis)trusting and (ab)using ssh. '
                                         'Retrieved January 8, 2018.',
                          'source_name': 'Slideshare Abusing SSH',
                          'url': 'https://www.slideshare.net/morisson/mistrusting-and-abusing-ssh-13526219'},
                         {'description': 'Hodgson, M. (2019, May 8). '
                                         'Post-mortem and remediations for Apr '
                                         '11 security incident. Retrieved '
                                         'November 17, 2024.',
                          'source_name': 'Breach Post-mortem SSH Hijack',
                          'url': 'https://matrix.org/blog/2019/05/08/post-mortem-and-remediations-for-apr-11-security-incident/'}],
 'id': 'attack-pattern--4d2a5b3e-340d-4600-9123-309dd63c9bf8',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'lateral-movement'}],
 'modified': '2025-10-24T17:48:45.240Z',
 'name': 'SSH Hijacking',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Anastasios Pingios'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Linux', 'macOS'],
 'x_mitre_version': '1.1'}