CyberStack

MITRE ATT&CK / Techniques / T1021.002

Remote Services: SMB/Windows Admin Shares

ID
T1021.002
Tactics
TA0008 Lateral Movement
Sub-technique of
T1021 Remote Services
Platforms
Windows
Data sources
Logon Session Creation, Network Connection Creation, Process Creation
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.

Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$. Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over SMB,[2] to interact with systems using remote procedure calls (RPCs),[3] transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation. Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels.[4]

Detection

Mitigations (4)

M1026 Privileged Account Management

Deny remote use of local admin credentials to log into systems. Do not allow domain user accounts to be in the local Administrators group multiple systems.

M1027 Password Policies

Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed.

M1035 Limit Access to Resource Over Network

Consider disabling Windows administrative shares.

M1037 Filter Network Traffic

Consider using the host firewall to restrict file sharing communications such as SMB. [1]

Groups (28)

Software (31)

References

  1. Microsoft Preventing SMB
  2. Wikipedia Server Message Block
  3. TechNet RPC
  4. Microsoft Admin Shares