Wiki › Techniques, Tactics & Procedures (TTPs) › Lateral Movement › Windows Admin Shares Abuse

Windows Admin Shares Abuse

3 min read

Jump to:

Overview

Windows Admin Shares Abuse is a technique where adversaries leverage default administrative network shares on Windows systems to gain unauthorized access and move laterally within a network. These hidden shares, such as C$, ADMIN$, and IPC$, provide remote access to system resources and are commonly targeted during various stages of an attack lifecycle to facilitate execution, persistence, and lateral movement.

Attack Objective

Gain unauthorized access to system resources and credentials
Support multiple attack lifecycle stages including Initial Access, Execution, Persistence, Privilege Escalation, and Lateral Movement
Advance attacker control by enabling remote file access, execution of commands, and deployment of additional tools or malware

How the Technique Works

Windows Admin Shares Abuse exploits the default administrative shares automatically created on Windows systems that allow remote access to system drives and administrative functions. Adversaries use valid credentials or stolen tokens to connect to these shares over SMB or other protocols, enabling them to upload, download, or execute files remotely. This access facilitates the deployment of payloads, credential harvesting, and lateral movement without requiring additional software installation.

Common Methods & Variations

Use of legitimate credentials or pass-the-hash techniques to authenticate to admin shares
Exploitation of on-premises Windows environments, with some cloud-hosted Windows instances also susceptible
Leveraging built-in Windows tools (e.g., PowerShell, Windows Management Instrumentation) to interact with admin shares (living-off-the-land)
Custom scripts or malware that automate connection and execution via admin shares

Indicators of Compromise (IOCs)

Unusual SMB connections to administrative shares (e.g., C$, ADMIN$) from non-administrative hosts
Authentication logs showing access to admin shares by unexpected accounts or at unusual times
Creation or modification of files within administrative shares inconsistent with normal operations
Execution of remote commands or scripts via SMB or WMI on endpoints

Detection Strategies

Monitoring SMB and RPC traffic for connections to admin shares outside of normal patterns
Analyzing authentication logs for anomalous access to administrative shares
Behavioral detection focusing on lateral movement patterns and use of living-off-the-land binaries
Correlation of endpoint process execution with network share access events

Mitigation & Prevention

Restrict access to administrative shares through network segmentation and firewall rules
Enforce the principle of least privilege for user accounts and administrative groups
Disable or rename default admin shares where feasible
Implement strong credential management, including multi-factor authentication and credential hygiene
Regularly audit and monitor access to administrative shares

Response Considerations

Immediately isolate affected systems to prevent further lateral movement
Investigate authentication and access logs to identify compromised accounts and scope of access
Reset credentials and review account permissions for accounts used in the abuse
Conduct forensic analysis on accessed shares to identify deployed tools or malware
Harden configurations and update policies to prevent recurrence

Related Techniques

Credential Dumping – to obtain credentials used for authenticating to admin shares
Pass-the-Hash – to authenticate without plaintext passwords
Remote File Copy – for transferring tools or payloads via admin shares
Windows Management Instrumentation (WMI) – for remote command execution
SMB/Windows Admin Shares – as part of lateral movement and persistence strategies

Mapping & References

MITRE ATT&CK Tactic/Technique: TA0001 Initial Access, TA0002 Execution, TA0003 Persistence, TA0004 Privilege Escalation, TA0008 Lateral Movement – T1077 Windows Admin Shares
Microsoft Security Documentation on Admin Shares and SMB Security
Public incident reports detailing lateral movement via Windows Admin Shares

Tags: Credential Abuse Defense Evasion Execution Initial Access lateral movement network security persistence privilege escalation SMB Windows Admin Shares