T1021.002 SMB/Windows Admin Shares

T1021.002 SMB/Windows Admin Shares

Sub-technique of: T1021

High-Level Description

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.

Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$. Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over SMB, to interact with systems using remote procedure calls (RPCs), transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation. Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels.

Kill Chain Phase

• Lateral Movement (TA0008)

Platforms: Windows

What to Check

• Identify if SMB/Windows Admin Shares technique is applicable to target environment
• Check Windows systems for indicators of SMB/Windows Admin Shares
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Map admin share

Connecting To Remote Shares

Supported Platforms: windows

cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"