T1021.002Lateral Movement
SMB/Windows Admin Shares
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
38 Sigma rules tagged T1021.002SMB/Windows Admin SharesT1021.00238 general rules
- CobaltStrike Service Installations - Systemcriticaltest
- Potential DCOM InternetExplorer.Application DLL Hijackcriticaltest
- Potential DCOM InternetExplorer.Application DLL Hijack - Image Loadcriticaltest
- Turla Group Lateral Movementcriticaltest
- Wmiprvse Wbemcomn DLL Hijack - Filecriticaltest
- CobaltStrike Service Installations - Securityhightest
- DCOM InternetExplorer.Application Iertutil DLL Hijack - Securityhightest
- First Time Seen Remote Named Pipehightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to SMB/Windows Admin Shares
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.