MITRE ATT&CK technique

T1077

Windows Admin Shares

About this technique

Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include <code>C$</code>, <code>ADMIN$</code>, and <code>IPC$</code>.

Read the full ATT&CK description

Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over server message block (SMB) (Citation: Wikipedia SMB) to interact with systems using remote procedure calls (RPCs), (Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution.

Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation.

Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels. (Citation: Microsoft Admin Shares)

The Net utility can be used to connect to Windows admin shares on remote systems using <code>net use</code> commands with valid credentials. (Citation: Technet Net Use)

TA0008
Curated mapping

Curated incident relationships

These associations come from maintained incident records. The recorded confidence is shown when the source record provides it.

0 items
No curated incident mappings yet.
Heuristic association

Daily items linked through predicted CVEs

A Daily item appears here when it mentions a CVE whose triage artifact predicts this technique. This is not a verified ATT&CK mapping.

0 items
No heuristic Daily associations yet.
Heuristic association

Predicted CVE associations

These backfilled or model-produced candidates come from the current triage artifact. They are informational, not official MITRE mappings.

0 items
No predicted associations yet for this technique.