| ID | Name |
|---|---|
| T1021.001 | Remote Desktop Protocol |
| T1021.002 | SMB/Windows Admin Shares |
| T1021.003 | Distributed Component Object Model |
| T1021.004 | SSH |
| T1021.005 | VNC |
| T1021.006 | Windows Remote Management |
| T1021.007 | Cloud Services |
| T1021.008 | Direct Cloud VM Connections |
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.
Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$. Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over SMB,[1] to interact with systems using remote procedure calls (RPCs),[2] transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation. Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels.[3]
| ID | Name | Description |
|---|---|---|
| C0025 | 2016 Ukraine Electric Power Attack |
During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized |
| S0504 | Anchor | |
| G0007 | APT28 |
APT28 has mapped network drives using Net and administrator credentials.[6] |
| G0022 | APT3 |
APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.[7] |
| G0050 | APT32 |
APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.[8] |
| G0087 | APT39 | |
| G0096 | APT41 |
APT41 has transferred implant files using Windows Admin Shares and the Server Message Block (SMB) protocol, then executes files through Windows Management Instrumentation (WMI).[10][11] |
| G0143 | Aquatic Panda |
Aquatic Panda used remote shares to enable lateral movement in victim environments.[12] |
| S0089 | BlackEnergy |
BlackEnergy has run a plug-in on a victim to spread through the local network by using PsExec and accessing admin shares.[13] |
| G0108 | Blue Mockingbird |
Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.[14] |
| S1063 | Brute Ratel C4 |
Brute Ratel C4 has the ability to use SMB to pivot in compromised networks.[15][16][17] |
| G0114 | Chimera |
Chimera has used Windows admin shares to move laterally.[18][19] |
| G1021 | Cinnamon Tempest |
Cinnamon Tempest has used SMBexec for lateral movement.[20] |
| S0154 | Cobalt Strike |
Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement.[21][22] |
| S0608 | Conficker |
Conficker variants spread through NetBIOS share propagation.[23] |
| S0575 | Conti |
Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.[24][25] |
| C0029 | Cutting Edge |
During Cutting Edge, threat actors moved laterally using compromised credentials to connect to internal Windows systems with SMB.[26] |
| G0009 | Deep Panda |
Deep Panda uses net.exe to connect to network shares using |
| S0659 | Diavol |
Diavol can spread throughout a network via SMB prior to encryption.[28] |
| S0038 | Duqu |
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.[29] |
| S0367 | Emotet |
Emotet has leveraged the Admin$, C$, and IPC$ shares for lateral movement. [30][31] |
| G1016 | FIN13 |
FIN13 has leveraged SMB to move laterally within a compromised network via application servers and SQL servers.[32] |
| G0061 | FIN8 |
FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context. FIN8 has also used smbexec from the Impacket suite for lateral movement.[33][34] |
| G0117 | Fox Kitten |
Fox Kitten has used valid accounts to access SMB shares.[35] |
| S0698 | HermeticWizard |
HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems.[36] |
| C0038 | HomeLand Justice |
During HomeLand Justice, threat actors used SMB for lateral movement.[37][38] |
| G0004 | Ke3chang |
Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.[39][40] |
| S0236 | Kwampirs |
Kwampirs copies itself over network shares to move laterally on a victim network.[41] |
| G0032 | Lazarus Group |
Lazarus Group malware SierraAlfa accesses the |
| S0532 | Lucifer | |
| G1009 | Moses Staff |
Moses Staff has used batch scripts that can enable SMB on a compromised host.[45] |
| S0039 | Net |
Lateral movement can be done with Net through |
| S0056 | Net Crawler |
Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.[47] |
| S0368 | NotPetya |
NotPetya can use PsExec, which interacts with the |
| S0365 | Olympic Destroyer |
Olympic Destroyer uses PsExec to interact with the |
| C0014 | Operation Wocao |
During Operation Wocao, threat actors used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.[52] |
| G0071 | Orangeworm |
Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.[41] |
| G1040 | Play |
Play has used Cobalt Strike to move laterally via SMB.[53] |
| S0029 | PsExec |
PsExec, a tool that has been used by adversaries, writes programs to the |
| S0019 | Regin |
The Regin malware platform can use Windows admin shares to move laterally.[54] |
| S1073 | Royal | |
| S0446 | Ryuk |
Ryuk has used the C$ network share for lateral movement.[56] |
| G0034 | Sandworm Team |
Sandworm Team has copied payloads to the |
| S0140 | Shamoon |
Shamoon accesses network share(s), enables share access to the target device, copies an executable payload to the target system, and uses a Scheduled Task/Job to execute the malware.[58] |
| C0024 | SolarWinds Compromise |
During the SolarWinds Compromise, APT29 used administrative accounts to connect over SMB to targeted users.[59] |
| S0603 | Stuxnet | |
| G0028 | Threat Group-1314 |
Threat Group-1314 actors mapped network drives using |
| G1022 | ToddyCat |
ToddyCat has used locally mounted network shares for lateral movement through targated environments.[62] |
| G0010 | Turla |
Turla used |
| G0102 | Wizard Spider |
Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.[64][65] |
| S0672 | Zox | |
| S0350 | zwShell |
zwShell has been copied over network shares to move laterally.[67] |
| ID | Mitigation | Description |
|---|---|---|
| M1037 | Filter Network Traffic |
Consider using the host firewall to restrict file sharing communications such as SMB. [68] |
| M1035 | Limit Access to Resource Over Network |
Consider disabling Windows administrative shares. |
| M1027 | Password Policies |
Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed. |
| M1026 | Privileged Account Management |
Deny remote use of local admin credentials to log into systems. Do not allow domain user accounts to be in the local Administrators group multiple systems. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that connect to remote shares, such as Net, on the command-line interface and Discovery techniques that could be used to find remotely accessible systems.[69] Note: Event ID 4104 (from the Microsoft-Windows-Powershell/Operational log) captures Powershell script blocks, which can be analyzed and used to detect on potential connections and writing to remote shares. |
| DS0028 | Logon Session | Logon Session Creation |
Monitor for logon behavior (ex: EID 4624 Logon Type 3) using Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. Ensure that proper logging of accounts used to log into systems is turned on and centrally collected. Windows logging is able to collect success/failure for accounts that may be used to move laterally and can be collected using tools such as Windows Event Forwarding. [70][71] |
| DS0033 | Network Share | Network Share Access |
Monitor interactions with network shares, such as reads or file transfers, using Server Message Block (SMB). |
| DS0029 | Network Traffic | Network Connection Creation |
Monitor for newly constructed network connections (typically over ports 139 or 445), especially those that are sent or received by abnormal or untrusted hosts. Correlate these network connections with remote login events and associated SMB-related activity such as file transfers and remote process execution. Note: Event ID is for Zeek but can also be implemented in other Network Analysis Frameworks by parsing & decoding captured SMB2 network traffic. Preference would be to detect smb2_write_response event (instead of smb2_write_request), because it would confirm the file was actually written to the remote destination. Unfortunately, Bro/Zeek does not have an event for that SMB message-type yet. From a network traffic capture standpoint, it’s important to capture the right traffic for this type of detection to function (e.g., all endpoint to endpoint if possible or workstation to server and workstation to workstation). As such, it is helpful to have a centralized server area where it is possible to monitor communications between servers and endpoints. Analytic 1 and 2 are very similar, with the key difference being that Implementation 2 is intended to capture multiple attempts at lateral movement originating from the same host within a short time period (5 minutes).
From a network traffic capture standpoint, it’s important to capture the right traffic for this type of detection to function (e.g., all endpoint to endpoint if possible or workstation to server and workstation to workstation). As such, it is helpful to have a centralized server area where it is possible to monitor communications between servers and endpoints.The Service Control Manager (SCM) can be used to copy a file to the ADMIN$ share and execute it as a service. This can be detected by looking for incoming RPC network connections to the Service Control Manager, followed by services.exe spawning a child process. Analytic 1 - Basic
|
| Network Traffic Flow |
Monitor network data for uncommon SMB data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Network Analysis frameworks such as Zeek can be used to capture, decode, and alert on SMB network flows. Notes:
Analytic 1 - SMB Write
|
||
| DS0009 | Process | Process Creation |
Monitor for the creation of WMI Win32_Process class and method Create to interact with a remote network share using Server Message Block (SMB). Relevant indicators detected by Bro/Zeek is IWbemServices::ExecMethod or IWbemServices::ExecMethodAsync. One thing to notice is that when the Create method is used on a remote system, the method is run under a host process named "Wmiprvse.exe". The process WmiprvSE.exe is what spawns the process defined in the CommandLine parameter of the Create method. Therefore, the new process created remotely will have Wmiprvse.exe as a parent. WmiprvSE.exe is a DCOM server and it is spawned underneath the DCOM service host svchost.exe with the following parameters C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p. From a logon session perspective, on the target, WmiprvSE.exe is spawned in a different logon session by the DCOM service host. However, whatever is executed by WmiprvSE.exe occurs on the new network type (3) logon session created by the user that authenticated from the network. Analytic 1 - Basic
|