type: attack-pattern
spec_version: 2.1
id: attack-pattern--ffe742ed-9100-4686-9e00-c331da544787
created: 2017-05-31T21:31:00.200Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1077
external_id: T1077
source_name: capec
url: https://capec.mitre.org/data/definitions/561.html
external_id: CAPEC-561
source_name: Wikipedia SMB
description: Wikipedia. (2016, June 12). Server Message Block. Retrieved June 12, 2016.
url: https://en.wikipedia.org/wiki/Server_Message_Block
source_name: TechNet RPC
description: Microsoft. (2003, March 28). What Is RPC?. Retrieved June 12, 2016.
url: https://technet.microsoft.com/en-us/library/cc787851.aspx
source_name: Microsoft Admin Shares
description: Microsoft. (n.d.). How to create and delete hidden or administrative shares on client computers. Retrieved November 20, 2014.
url: http://support.microsoft.com/kb/314984
source_name: Technet Net Use
description: Microsoft. (n.d.). Net Use. Retrieved November 25, 2016.
url: https://technet.microsoft.com/bb490717.aspx
source_name: Lateral Movement Payne
description: Payne, J. (2015, November 26). Tracking Lateral Movement Part One - Special Groups and Specific Service Accounts. Retrieved February 1, 2016.
url: https://docs.microsoft.com/en-us/archive/blogs/jepayne/tracking-lateral-movement-part-one-special-groups-and-specific-service-accounts
source_name: Windows Event Forwarding Payne
description: Payne, J. (2015, November 23). Monitoring what matters - Windows Event Forwarding for everyone (even if you already have a SIEM.). Retrieved February 1, 2016.
url: https://docs.microsoft.com/en-us/archive/blogs/jepayne/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem
source_name: Medium Detecting Lateral Movement
description: French, D. (2018, September 30). Detecting Lateral Movement Using Sysmon and Splunk. Retrieved October 11, 2019.
url: https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:40.422Z
name: Windows Admin Shares
description: Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$. 

Adversaries may use this technique in conjunction with administrator-level [Valid Accounts](https://attack.mitre.org/techniques/T1078) to remotely access a networked system over server message block (SMB) (Citation: Wikipedia SMB) to interact with systems using remote procedure calls (RPCs), (Citation: TechNet RPC) transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), [Service Execution](https://attack.mitre.org/techniques/T1035), and [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047). Adversaries can also use NTLM hashes to access administrator shares on systems with [Pass the Hash](https://attack.mitre.org/techniques/T1075) and certain configuration and patch levels. (Citation: Microsoft Admin Shares)

The [Net](https://attack.mitre.org/software/S0039) utility can be used to connect to Windows admin shares on remote systems using net use commands with valid credentials. (Citation: Technet Net Use)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: lateral-movement
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_version: 1.2