Applied Cybernetics Group
T1021.002 SMB/Windows Admin Shares
- Technique
T1021.002- Tactics
- Lateral Movement
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 38
- Elastic, Splunk
- 34
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1021/002
MITRE description
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba. Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include `C$`, `ADMIN$`, and `IPC$`. Adversaries may use this technique in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely access a networked system over SMB,(Citation: Wikipedia Server Message Block) to interact with systems using remote procedure calls (RPCs),(Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), [Service Execution](https://attack.mitre.org/techniques/T1569/002), and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries can also use NTLM hashes to access administrator shares on systems with [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) and certain configuration and patch levels.(Citation: Microsoft Admin Shares)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-29Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Detection coverage
SigmaHQ community rules
- Turla Group Lateral Movement (emerging-threats)
- Net.EXE Execution (threat-hunting)
- SMB Spoolss Name Piped Usage (core)
- First Time Seen Remote Named Pipe - Zeek (core)
- Suspicious PsExec Execution - Zeek (core)
- Access To ADMIN$ Network Share (core)
- CobaltStrike Service Installations - Security (core)
- DCERPC SMB Spoolss Named Pipe (core)
- DCOM InternetExplorer.Application Iertutil DLL Hijack - Security (core)
- Impacket PsExec Execution (core)
- First Time Seen Remote Named Pipe (core)
- Metasploit SMB Authentication (core)
- Metasploit Or Impacket Service Installation Via SMB PsExec (core)
- Protected Storage Service Access (core)
- SMB Create Remote File Admin Share (core)
- Suspicious PsExec Execution (core)
- Remote Service Activity via SVCCTL Named Pipe (core)
- T1047 Wmiprvse Wbemcomn DLL Hijack (core)
- Unsigned or Unencrypted SMB Connection to Share Established (core)
- CobaltStrike Service Installations - System (core)
- smbexec.py Service Installation (core)
- Potential DCOM InternetExplorer.Application DLL Hijack (core)
- HackTool - NetExec File Indicators (core)
- Wmiprvse Wbemcomn DLL Hijack - File (core)
- Potential DCOM InternetExplorer.Application DLL Hijack - Image Load (core)
Showing 25 of 38 community rules.
the full set is tagged attack.t1021.002 in
SigmaHQ.
Elastic and Splunk rules
- Attempt to Mount SMB Share via Command Line (elastic)
- Potential Machine Account Relay Attack via SMB (elastic)
- Windows Registry File Creation in SMB Share (elastic)
- Protected Storage Service Access via SMB (elastic)
- Suspicious Remote Registry Access via SeBackupPrivilege (elastic)
- Potential PowerShell HackTool Script by Function Names (elastic)
- PsExec Network Connection (elastic)
- Suspicious Execution from a WebDav Share (elastic)
- Suspicious Process Execution via Renamed PsExec Executable (elastic)
- Potential Ransomware Behavior - Note Files by System (elastic)
- Suspicious File Renamed via SMB (elastic)
- Potential Ransomware Note File Dropped via SMB (elastic)
- Service Command Lateral Movement (elastic)
- NullSessionPipe Registry Modification (elastic)
- SMB Connections via LOLBin or Untrusted Process (elastic)
- Potential Lateral Tool Transfer via SMB Share (elastic)
- Remote Execution via File Shares (elastic)
- Mounting Hidden or WebDav Remote Shares (elastic)
- Remote File Copy to a Hidden Share (elastic)
- Remote Windows Service Installed (elastic)
- Lateral Movement via Startup Folder (elastic)
- Potential Network Share Discovery (elastic)
- Detect PsExec With accepteula Flag (splunk)
- Executable File Written in Administrative SMB Share (splunk)
- Impacket Lateral Movement Commandline Parameters (splunk)
Showing 25 of 34.