T1077
About this technique
Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include <code>C$</code>, <code>ADMIN$</code>, and <code>IPC$</code>.
Read the full ATT&CK description
Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over server message block (SMB) (Citation: Wikipedia SMB) to interact with systems using remote procedure calls (RPCs), (Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution.
Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation.
Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels. (Citation: Microsoft Admin Shares)
The Net utility can be used to connect to Windows admin shares on remote systems using <code>net use</code> commands with valid credentials. (Citation: Technet Net Use)
Curated incident relationships
These associations come from maintained incident records. The recorded confidence is shown when the source record provides it.
Daily items linked through predicted CVEs
A Daily item appears here when it mentions a CVE whose triage artifact predicts this technique. This is not a verified ATT&CK mapping.
Predicted CVE associations
These backfilled or model-produced candidates come from the current triage artifact. They are informational, not official MITRE mappings.