SMB/Windows Admin Shares

Windows built into every domain: administrative shares (C$, ADMIN$, IPC$) that let an authenticated user with the right privileges reach a remote machine's filesystem over SMB, without any additional tooling. It exists for legitimate remote administration, and an attacker who's already stolen valid credentials gets it for free.

There's no exploit here. If the attacker has a working username and password (or a hash) for an account with local admin rights on the target, admin shares just work, exactly as designed.

Once an attacker has credentials for an account with reach beyond a single host (a domain admin, a local admin whose password is reused across machines, a compromised service account), admin shares are the simplest way to move: copy a tool or payload to \\target\C$, then trigger execution some other way (a scheduled task, a service, WMI).

It's popular specifically because it uses infrastructure that's already there and already permitted for IT operations. There's nothing to install or exploit, which means fewer opportunities to get caught by anything looking for unusual tooling.

Data source: Windows Security event log on the destination host -- network logon (Event 4624, type 3), its paired 4672 privilege grant, and 5145 file-share access records

{
  "host": {
    "name": "WKSTN01"
  },
  "event": {
    "action": "connection_accepted",
    "category": "network"
  },
  "process": {
    "pid": 4820,
    "name": "psexec.exe"
  },
  "destination": {
    "ip": "10.1.10.12",
    "port": 445
  }
}

Prebuilt Elastic rule: Potential Lateral Tool Transfer via SMB Share

Two independent hunts worth running. First, executable files being created or modified on a network share: legitimate SMB traffic almost never involves writing a fresh .exe/.dll to a remote admin share. Second, SMB connections (port 445) initiated by a non-kernel process: the OS's own SMB stack runs as PID 4, so a connection from any other process is unusual on its face.

Hunting manually: filter file-creation events where the destination is a UNC path (\\hostname\C$\...) and the extension is executable, or filter network events on destination.port: 445 and process.pid != 4.

Admin shares are used constantly by legitimate IT operations. Software deployment tools, backup agents, and remote administration all rely on exactly this mechanism.

The distinguishing signal is source and pattern, not the share access itself: a known deployment tool (SCCM, a patch management agent) writing to shares from its usual service account, on its usual schedule, is expected. An interactive user account, a workstation that doesn't normally initiate this kind of traffic, or a burst of admin-share activity outside a maintenance window is the pattern worth escalating. If your environment has known deployment tooling, baseline its normal source hosts and accounts so deviations stand out.

• MITRE ATT&CK T1021.002: SMB/Windows Admin Shares
• Elastic Security: Potential Lateral Tool Transfer via SMB Share

1 scenario in this catalog covers T1021.002. We don't name it — identifying the technique is part of what a scenario grades. Explore the dashboard →