1. Home
  2. ATT&CK Techniques
  3. T1021.002 SMB/Windows Admin Shares

T1021.002 SMB/Windows Admin Shares

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.

Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$. Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over SMB,(Citation: Wikipedia Server Message Block) to interact with systems using remote procedure calls (RPCs),(Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation. Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels.(Citation: Microsoft Admin Shares)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.IR-01.05 Remote access protection Mitigates T1021.002 SMB/Windows Admin Shares
Comments
This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access.
References
    PR.AA-05.03 Service accounts Mitigates T1021.002 SMB/Windows Admin Shares
    Comments
    This diagnostic statement is for the implementation of security controls for service accounts (i.e., accounts used by systems to access other systems). Block the SMB/Windows Admin Shares service account to mitigate exploitation.
    References
      PR.AA-05.02 Privileged system access Mitigates T1021.002 SMB/Windows Admin Shares
      Comments
      This diagnostic statement protects against SMB/Windows Admin Shares through the use of privileged account management and the use of multi-factor authentication.
      References
        DE.CM-06.02 Third-party access monitoring Mitigates T1021.002 SMB/Windows Admin Shares
        Comments
        This diagnostic statement protects against SMB/Windows Admin Shares through the use of privileged account management. Employing auditing, privilege access management, and just in time access protects against adversaries trying to obtain illicit access to critical systems.
        References
          PR.PS-01.09 Virtualized end point protection Mitigates T1021.002 SMB/Windows Admin Shares
          Comments
          The diagnostic statement highlights several mechanisms that organizations can implement to protect endpoint systems using virtualization technologies, essentially hypervisor hardening. With this technique, adversaries may transfer tools, payloads, or other malware between systems in a compromised environment, such as between a VM and host system. Hypervisor hardening may help in monitoring and restricting unexpected network share access, such as files transferred between shares within a network using protocols such as SMB by virtualized technologies.
          References
            PR.IR-04.01 Utilization monitoring Mitigates T1021.002 SMB/Windows Admin Shares
            Comments
            This diagnostic statement describes how the organization establishes and manages baseline measures of network activity. Supported by network monitoring tools and other controls to detect events and identify incidents. Mitigating mechanisms may include: Data Loss Prevention (DLP); Filtering Network Traffic; Limit Network Traffic; Network Intrusion Prevention Systems (NIPS); and Network Segmentation for these type of network-based techniques.
            References
              PR.IR-01.03 Network communications integrity and availability Mitigates T1021.002 SMB/Windows Admin Shares
              Comments
              This diagnostic statement protects against SMB/Windows Admin Shares through the use of secure network configurations, architecture, implementations of zero trust architecture, and segmentation.
              References
                PR.IR-01.04 Wireless network protection Mitigates T1021.002 SMB/Windows Admin Shares
                Comments
                This diagnostic statement provides protections for wireless networks. Implementation of wireless network management measures such as network segmentation and access controls reduces the attack surface, restricts movement by adversaries, and protects data from compromise.
                References
                  PR.IR-01.06 Production environment segregation Mitigates T1021.002 SMB/Windows Admin Shares
                  Comments
                  This diagnostic statement provides protections for production environments. Measures such as network segmentation and access control reduce the attack surface, restrict movement by adversaries, and protect critical assets and data from compromise.
                  References
                    PR.AA-01.01 Identity and credential management Mitigates T1021.002 SMB/Windows Admin Shares
                    Comments
                    This diagnostic statement protects against SMB/Windows Admin Shares through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
                    References
                      PR.PS-01.08 End-user device protection Mitigates T1021.002 SMB/Windows Admin Shares
                      Comments
                      This diagnostic statement protects against SMB/Windows Admin Shares through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
                      References

                        NIST 800-53 Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        CA-07 Continuous Monitoring mitigates T1021.002 SMB/Windows Admin Shares
                        CM-06 Configuration Settings mitigates T1021.002 SMB/Windows Admin Shares
                        CM-05 Access Restrictions for Change mitigates T1021.002 SMB/Windows Admin Shares
                        AC-17 Remote Access mitigates T1021.002 SMB/Windows Admin Shares
                        SI-10 Information Input Validation mitigates T1021.002 SMB/Windows Admin Shares
                        SI-15 Information Output Filtering mitigates T1021.002 SMB/Windows Admin Shares
                        CM-02 Baseline Configuration mitigates T1021.002 SMB/Windows Admin Shares
                        IA-02 Identification and Authentication (Organizational Users) mitigates T1021.002 SMB/Windows Admin Shares
                        CM-07 Least Functionality mitigates T1021.002 SMB/Windows Admin Shares
                        SI-04 System Monitoring mitigates T1021.002 SMB/Windows Admin Shares
                        AC-02 Account Management mitigates T1021.002 SMB/Windows Admin Shares
                        AC-03 Access Enforcement mitigates T1021.002 SMB/Windows Admin Shares
                        AC-04 Information Flow Enforcement mitigates T1021.002 SMB/Windows Admin Shares
                        AC-05 Separation of Duties mitigates T1021.002 SMB/Windows Admin Shares
                        AC-06 Least Privilege mitigates T1021.002 SMB/Windows Admin Shares
                        SC-07 Boundary Protection mitigates T1021.002 SMB/Windows Admin Shares

                        Azure Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        azure_network_security_groups Azure Network Security Groups technique_scores T1021.002 SMB/Windows Admin Shares
                        Comments
                        This control can be used to restrict direct access to remote services to trusted networks. This mitigates even an adversary with a valid account from accessing resources. This can be circumvented though if an adversary is able to compromise a trusted host and move laterally to a protected network. This results in an overall partial (coverage) score.
                        References
                        1. https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
                        azure_network_watcher_traffic_analytics Azure Network Watcher: Traffic Analytics technique_scores T1021.002 SMB/Windows Admin Shares
                        Comments
                        This control can detect anomalous traffic with respect to remote access protocols and groups.
                        References
                        1. https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics?tabs=Americas

                        GCP Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        security_command_center Security Command Center technique_scores T1021.002 SMB/Windows Admin Shares
                        Comments
                        Chronicle is able to trigger an alert for net use commands detected for SMB/Windows admin shares (e.g., " net use.* (C|ADMIN|IPC)$"). This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/783e0e5947774785db1c55041b70176deeca6f46/soc_prime_rules/threat_hunting/windows/possible_system_network_connections_discovery__sysmon_windows_logs.yaral
                        References
                        1. ['https://cloud.google.com/security/products/security-operations'
                        2. 'https://github.com/chronicle/detection-rules']

                        AWS Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        amazon_virtual_private_cloud Amazon Virtual Private Cloud technique_scores T1021.002 SMB/Windows Admin Shares
                        Comments
                        VPC security groups and network access control lists (NACLs) can be used to restrict direct access to remote services to trusted networks. This mitigates even an adversary with a valid account from accessing resources. This can be circumvented though if an adversary is able to compromise a trusted host and move laterally to a protected network. This results in an overall partial (coverage) score.
                        References
                          aws_network_firewall AWS Network Firewall technique_scores T1021.002 SMB/Windows Admin Shares
                          Comments
                          AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to only allow remote services from trusted hosts (i.e., only allow remote access traffic from certain hosts). This mapping is given a score of Partial because even though it can restrict remote services traffic from untrusted hosts, it cannot protect against an adversary using a trusted host that is permitted to use remote services as part of an attack.
                          References