TechKnowSurge
TechKnowSurge Catalog Videos Concurrent Session Usage
VideoSecurityFree

Concurrent Session Usage

Concurrent session usage occurs when an adversary accesses a compromised machine without disconnecting the legitimate user, allowing malicious activity to go undetected. Windows Task Manager's Users tab provides a straightforward way to identify multiple active sessions on a single system.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A common adversary technique on compromised systems is maintaining the existing user session rather than terminating it, since an unexpected logoff would likely alert the user and trigger a security response. By operating concurrently with the legitimate user, an attacker can carry out malicious activity while remaining hidden in plain sight. This makes concurrent session detection an important part of identifying active compromises on workstations and endpoints. Windows Task Manager provides a practical, built-in method for checking active sessions. The Users tab displays every account currently logged into the system, making it easy to spot cases where more than one user is active at the same time. In a properly secured environment, most standard workstations should show only a single active session, so any additional entries warrant immediate investigation as a potential indicator of compromise.

What you'll learn

What's covered

Concurrent Session Usage

Key terms

Task Manager
A Windows utility (accessed via Ctrl+Shift+Esc) that displays running processes, application status, CPU and memory usage, and allows users to end unresponsive programs.
Threat Actor
An individual or group responsible for a security incident or attack.
Concurrent Session
A condition in which multiple users are actively logged into the same system simultaneously, which may indicate unauthorized access.
Unauthorized Access
Any entry or use of a system, facility, or resource without proper permission or authorization.

Topics

Concurrent Sessions Session Hijacking Windows Security Task Manager Threat Detection Operating Systems Unauthorized Access

Transcript

Concurrent session usage

If an adversary is on a machine, there's a good chance that there are other users on that machine as well, so we might see some concurrent session usage.

Let's say you have a user at a workstation, and then that workstation becomes compromised. If this user gets booted off, that's going to flag everybody that there could be some sort of attack going on, that there could be a compromise already. So what an adversary is going to want to do is access and use this machine at the same time that the end user is using this machine, and hopefully in secret from the adversary's perspective. So we're going to be looking for these concurrent session usages, to see if there are two people using a machine at the same time.

Checking in Task Manager

I'm on a Windows machine here, and what I'm going to do is type in task manager and open up Task Manager. Task Manager has several tabs here, to include looking at the performance and what the performance is doing. But what I'm going to do is click on the user tab, and we can see a user is logged in — this is me that's logged in. So what we'd be looking for here is multiple users logged into the system at the same time.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →