Full Report
Windows' administrative shares feature is often overlooked by users, but not by hackers. Learn how attackers abuse administrative shares to propagate.
Analysis Summary
# Tool/Technique: Windows Administrative Shares Abuse
## Overview
Administrative shares (also known as "hidden shares") are a default Windows feature designed to allow administrators and software to manage hosts remotely. These shares are identified by a "$" suffix (e.g., `C$`, `ADMIN$`), which instructs Windows to hide them from standard network browsing views. Attackers and wormable malware abuse these shares to move laterally across a network by copying and executing malicious payloads on remote systems.
## Technical Details
- **Type:** Technique (Lateral Movement)
- **Platform:** Windows
- **Capabilities:** Remote file system access, remote payload delivery, and remote execution support.
- **First Seen:** Long-standing native Windows feature; heavily exploited by worms since the early 2000s.
## MITRE ATT&CK Mapping
- **TA0008 - Lateral Movement**
- **T1021.002 - Remote Services: SMB/Windows Admin Shares**
- **TA0003 - Persistence**
- **T1543.003 - Create or Modify System Process: Windows Service** (often used in conjunction for execution)
- **TA0007 - Discovery**
- **T1135 - Network Share Discovery**
## Functionality
### Core Capabilities
- **Hidden Resource Access:** Allows access to the root of every drive (e.g., `\\host\C$`) and the Windows system directory (`\\host\ADMIN$`).
- **File Transfer:** Enables attackers to upload malicious binaries or scripts directly to the target system's disk.
- **Remote Management:** Provides a bridge for administrative tools to interact with the OS remotely.
### Advanced Features
- **PsExec-style Execution:** When combined with Service Control Manager (SCM) access, attackers can copy a file to an admin share and then remotely create a service to execute that file, achieving remote code execution (RCE).
- **Credential Harvesting Integration:** Malware automates the discovery of these shares and attempts to authenticate using brute-forced or stolen credentials (NTLM hashes or cleartext passwords).
## Indicators of Compromise
- **File Hashes:** N/A (Technique leverages native features; hashes vary by payload).
- **File Names:** Look for suspicious executables in `C:\Windows\` or `C:\Windows\System32\` frequently dropped via `ADMIN$`.
- **Registry Keys:** `HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy` (Often modified to enable remote admin share access for local accounts).
- **Network Indicators:**
- High volume of SMB traffic (TCP Port 445) between internal workstations.
- Connection attempts to `IPC$`, `C$`, or `ADMIN$` shares from unauthorized hosts.
- **Behavioral Indicators:**
- Execution of `net share` or `net view /all` to discover hidden shares.
- Use of `PsExec` or similar tools (e.g., PAExec, CSExec) to initiate remote services.
## Associated Threat Actors
- **Malware Families:**
- Emotet
- Trickbot
- Qakbot (Qbot)
- **General Groups:** Various Ransomware affiliates and Advanced Persistent Threat (APT) groups leveraging living-off-the-land (LotL) techniques.
## Detection Methods
- **Signature-based detection:** Monitoring for common lateral movement tools like `PsExec.exe` or unauthorized use of `sc.exe` for remote service creation.
- **Behavioral detection:**
- Monitoring for Windows Event ID 4624/4625 (Logon events) specifically involving Network Logon Type 3.
- Monitoring Event ID 5140 (A network share object was accessed).
- **YARA:** Detection of service-related artifacts left behind by PsExec-like tools in the `System` event log.
## Mitigation Strategies
- **LAPS Implementation:** Use Microsoft Local Administrator Password Solution (LAPS) to ensure every host has a unique, randomized local admin password, preventing "pass-the-hash" or credential reuse attacks.
- **Least Privilege:** Audit and restrict the number of accounts with administrative rights.
- **Disable Shares:** On non-server hosts (workstations), disable administrative shares via the registry (`AutoShareWks`).
- **Network Segmentation:** Use host-based firewalls to block inbound SMB (Port 445) between workstations.
## Related Tools/Techniques
- **PsExec:** A Sysinternals tool frequently used by both admins and attackers to execute processes on remote systems via admin shares.
- **SMB Signing:** A security mechanism to prevent man-in-the-middle attacks on SMB traffic.
- **Pass-the-Hash (T1550.002):** Often the method used to authenticate to these shares without knowing the cleartext password.