القائمة
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1021-002-smbwindows-admin-sharesيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
عرض SKILL.md
استنادا إلى تصنيف SOC المهني
| name | T1021.002_smbwindows-admin-shares |
| description | Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). |
| category | authorization |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1021.002","lateral-movement","windows","sub-technique"] |
| technique_id | T1021.002 |
| tactic | lateral-movement |
| all_tactics | ["lateral-movement"] |
| platforms | ["Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1021/002 |
| tech_stack | ["windows"] |
| cwe_ids | ["CWE-284"] |
| chains_with | ["T1021","T1021.001","T1021.003","T1021.004","T1021.005","T1021.006","T1021.007","T1021.008"] |
| prerequisites | ["T1021"] |
| severity_boost | {"T1021":"Chain with T1021 for deeper attack path","T1021.001":"Chain with T1021.001 for deeper attack path","T1021.003":"Chain with T1021.003 for deeper attack path"} |
Sub-technique of: T1021
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.
Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$. Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over SMB, to interact with systems using remote procedure calls (RPCs), transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation. Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels.
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Connecting To Remote Shares
Supported Platforms: windows
cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"
Map Admin share utilizing PowerShell
Supported Platforms: windows
New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}
Copies a file to a remote host and executes it using PsExec. Requires the download of PsExec from https://docs.microsoft.com/en-us/sysinternals/downloads/psexec.
Supported Platforms: windows Elevation Required: Yes
"#{psexec_exe}" #{remote_host} -accepteula -c #{command_path}
Dependencies:
Executes a command, writing the output to a local Admin Share. This technique is used by post-exploitation frameworks.
Supported Platforms: windows Elevation Required: Yes
cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file} 2>&1
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to SMB/Windows Admin Shares by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1021.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Deny remote use of local admin credentials to log into systems. Do not allow domain user accounts to be in the local Administrators group multiple systems.
Consider disabling Windows administrative shares.
Consider using the host firewall to restrict file sharing communications such as SMB.
Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed.
| Finding | Severity | Impact |
|---|---|---|
| SMB/Windows Admin Shares technique applicable | Low | Lateral Movement |
| CWE ID | Title |
|---|---|
| CWE-284 | Improper Access Control |