Full Report
Windows' administrative shares feature is often overlooked by users, but not by hackers. Learn how attackers abuse administrative shares to propagate.
Analysis Summary
# Tool/Technique: Windows Administrative Shares Abuse
## Overview
Administrative shares (also known as "hidden shares") are a default Windows feature designed for remote management by administrators and software. They are identified by a "$" suffix (e.g., `C$`, `ADMIN$`), which instructs Windows to hide them from standard network browsing views. Attackers and wormable malware abuse these shares to move laterally across a network, typically by copying malicious payloads to a remote system and executing them using stolen or brute-forced administrative credentials.
## Technical Details
- **Type**: Technique (leveraged by Malware Families)
- **Platform**: Windows
- **Capabilities**: Remote file system access, lateral movement, payload delivery, and remote execution.
- **First Seen**: Long-standing legacy feature of Windows NT-based systems.
## MITRE ATT&CK Mapping
- **TA0008 - Lateral Movement**
- **T1021.002 - Remote Services: SMB/Windows Admin Shares**: Using hidden shares to propagate and move between systems.
- **TA0003 - Persistence** / **TA0002 - Execution**
- **T1570 - Lateral Tool Transfer**: Copying malware binaries to remote admin shares.
- **T1569.002 - System Services: Service Execution**: Used in conjunction with tools like PsExec to execute the transferred payload.
## Functionality
### Core Capabilities
- **Hidden Storage**: Shares ending in `$` do not appear in Windows Explorer network browsing.
- **Default Accessibility**: Enabled by default on Windows systems for all disk volumes (`C$`, `D$`) and the system root (`ADMIN$`).
- **Remote File Management**: Allows users with administrative privileges to read, write, and delete files across the network.
### Advanced Features (Attacker/Malware Use)
- **Worming/Self-Propagation**: Malware can automate the discovery of these shares and drop copies of itself on neighboring machines.
- **PsExec-style Execution**: By combining `ADMIN$` share access with the Service Control Manager (SCM), attackers can execute commands on remote hosts.
- **Credential Harvesting**: Triggers the need for automated brute-forcing or credential stuffing to gain the required administrative access.
## Indicators of Compromise
- **File Names**: `remcom.exe`, `psexec.exe`, or randomly named `.exe`/`.dll` files appearing in `C:\Windows\` or `C:\Windows\System32\`.
- **Network Indicators**: Heavy SMB traffic (TCP Port 445) between workstations that do not typically communicate with each other.
- **Behavioral Indicators**:
- Execution of `net share` or `net view /all` to discover hidden shares.
- Use of `net use` to map drives to `C$` or `ADMIN$`.
- Sudden appearance of new, short-lived services on remote machines.
## Associated Threat Actors/Malware
- **Emotet**: Uses admin shares for rapid lateral movement and worming.
- **Trickbot**: Exploits shares to spread and deploy additional modules like TrickBoot.
- **Qakbot (Qbot)**: Frequently utilizes SMB-based propagation.
- **PsExec (Sysinternals)**: A legitimate tool frequently repurposed by threat actors for lateral movement.
## Detection Methods
- **Signature-based detection**: Scan for known PsExec variants or common malware droppers in the `ADMIN$` and `C$` paths.
- **Behavioral detection**:
- Monitor for successful logins to administrative shares from non-standard administrative workstations.
- Track Windows Event ID 5140 (A network share object was accessed), specifically looking for Access Mask requests to hidden shares.
- Alert on suspicious process creation where the parent is `services.exe` following an SMB file write.
## Mitigation Strategies
- **LAPS (Local Administrator Password Solution)**: Randomize local administrator passwords to prevent lateral movement via credential dumping.
- **Least Privilege**: Regularly audit and limit the number of accounts with administrative rights.
- **Network Segmentation**: Restrict internal SMB (Port 445) traffic between workstations; allow SMB only to necessary servers (e.g., File Servers).
- **Disable Shares**: Disable administrative shares on non-essential hosts (workstations) via registry modifications (e.g., `AutoShareWks`).
- **Endpoint Isolation**: Utilize host isolation tools once an infection is detected to stop the "worm" behavior.
## Related Tools/Techniques
- **SMB (Server Message Block)**: The underlying protocol for administrative shares.
- **PsExec / PaExec**: Tools used to execute processes on remote systems via admin shares.
- **Pass-the-Hash**: A technique often used to authenticate to admin shares without knowing the plaintext password.