Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment. Remote desktop is a common feature in operating systems. It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).(Citation: TechNet Remote Desktop Services)

Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session. Typically, a user is notified when someone else is trying to steal their session. With System permissions and using Terminal Services Console, `c:\windows\system32\tscon.exe [session number to be stolen]`, an adversary can hijack a session without the need for credentials or prompts to the user.(Citation: RDP Hijacking Korznikov) This can be done remotely or locally and with active or disconnected sessions.(Citation: RDP Hijacking Medium) It can also lead to [Remote System Discovery](https://attack.mitre.org/techniques/T1018) and Privilege Escalation by stealing a Domain Admin or higher privileged account session. All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.(Citation: Kali Redsnarf)
RDP Hijacking
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1563/002  external_id: T1563.002     source_name: RDP Hijacking Medium  description: Beaumont, K. (2017, March 19). RDP hijacking — how to hijack RDS and RemoteApp sessions transparently to move through an organisation. Retrieved December 11, 2017.  url: https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6     source_name: RDP Hijacking Korznikov  description: Korznikov, A. (2017, March 17). Passwordless RDP Session Hijacking Feature All Windows versions. Retrieved December 11, 2017.  url: http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html     source_name: TechNet Remote Desktop Services  description: Microsoft. (n.d.). Remote Desktop Services. Retrieved June 1, 2016.  url: https://technet.microsoft.com/en-us/windowsserver/ee236407.aspx     source_name: Kali Redsnarf  description: NCC Group PLC. (2016, November 1). Kali Redsnarf. Retrieved December 11, 2017.  url: https://github.com/nccgroup/redsnarf     