tfMITRE ATT&CK sub-technique

SMB/Windows Admin Shares T1021.002

Tactic: Lateral Movement
Platform: Windows
Version: 1.3
Created: 11 February 2020
Last modified: 12 May 2026

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 6%

Threat groups94th percentile · 94% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 5%

Campaigns95th percentile · 95% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 12%

Tools & malware88th percentile · 88% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 4%

Detection rules96th percentile · 96% of ATT&CK techniques have this many detection rules written or fewer.

SMB/Windows Admin Shares MITRE reference T1021.002

Top 6%of all ATT&CK techniques for number of groups

27 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

MirrorFaceG1054 ↗

Has used SMB to copy malware between systems in compromised environments.1 2

created 2026-04-172 referencesaka Earth Kasha

Velvet AntG1047 ↗

Has transferred tools within victim environments using SMB.1

created 2025-03-141 reference

Storm-1811G1046 ↗

Has attempted to move laterally in victim environments via SMB using Impacket.1

created 2025-03-141 reference

BlackByteG1043 ↗

Used SMB file shares to distribute payloads throughout victim networks, including BlackByte ransomware variants during wormable operations.1 2 3

created 2024-12-163 referencesaka Hecamede

PlayG1040 ↗

Has used Cobalt Strike to move laterally via SMB.1

created 2024-09-241 reference

ToddyCatG1022 ↗

Has used locally mounted network shares for lateral movement through targated environments.1

created 2024-01-031 reference

All 27 groups for this technique · 6 newest in this preview

Offense vs defense T1021.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 8Sigma rules (cumulative) · 41Splunk ESCU (cumulative) · 13

first rule: 2017 Q1 · 8 of 8 campaigns plotted

SMB/Windows Admin Shares detection strategy DET0530

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Multi-Event Detection for SMB Admin Share Lateral Movement

Enterprise

1 platform

AN1468 · Windows

An SMB-based remote file share access followed by lateral movement actions such as remote service creation, task scheduling, or suspicious process execution on the target host using ADMIN$ or C$ shares.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ShareName	Targeted admin share path, such as C$, ADMIN$, IPC$
TimeWindow	Correlation window between remote file access and remote execution (e.g., 5-10 minutes)
UserContext	Distinguish expected remote administrators vs. rare/first-time access by specific users
ProcessList	List of suspicious binaries or tools executed post remote copy (e.g., cmd.exe, powershell.exe, runonce.exe)

5 analytics

Server Message Block (SMB) is used by Windows to allow for file, pipe, and printer sharing over port 445/tcp. It allows for enumerating, and reading from and writing to file shares for a remote computer. Although it is heavily used by Windows servers for legitimate purposes and by users for file and printer sharing, many adversaries also use SMB to achieve Lateral Movement. Looking at this activity more closely to obtain an adequate sense of situational awareness may make it possible to detect adversaries moving between hosts in a way that deviates from normal activity. Because SMB traffic is heavy in many environments, this analytic may be difficult to turn into something that can be used to quickly detect an APT. In some cases, it may make more sense to run this analytic in a forensic fashion. Looking through and filtering its output after an intrusion has been discovered may be helpful in identifying the scope of compromise.

TypeSituational AwarenessCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-IPCTA	IPC Traffic Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	message	dest_port
flow	message	proto_info

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Although there may be more native ways to detect detailed SMB events on the host, they can be extracted out of network traffic. With the right protocol decoders, port 445 traffic can be filtered and even the file path (relative to the share) can be retrieved.

flow = search Flow:Message
smb_events = filter flow where (dest_port == "445" and protocol == "smb")
smb_events.file_name = smb_events.proto_info.file_name
output smb_write

Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.

TypeTTPCoverageLowSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	hostname
process	create	ppid
process	create	exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

processes = search Process:Create
reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe"
 or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe"
 or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe"
 or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe"
 or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe"
 or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe"
 or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe"
 or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe"
 or exe == "wscript.exe" or exe == "xcopy.exe")
reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes)
output reg_grouped

DNIF version of the above pseudocode.

_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100
>>_agg count
>>_checkif int_compare Count > 1 include

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"]
| chart count() as cnt by host
| search cnt > 1

Unit tests

CAR’s own validation procedures for this analytic.

Within a command window, execute several of the commands in quick succession.

["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]

As described in CAR-2013-01-003, SMB provides a means of remotely managing a file system. Adversaries often use SMB to move laterally to a host. SMB is commonly used to upload files. It may be used for staging in Exfiltration or as a Lateral Movement technique. Unlike SMB Reads, SMB Write requests typically require an additional level of access, resulting in less activity. Focusing on SMB Write activity narrows the field to find techniques that actively change remote hosts, instead of passively reading files.

TypesSituational Awareness, TTPCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-IPCTA	IPC Traffic Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	message	proto_info
flow	message	dest_port

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

flow = search Flow:Message
smb_write = filter flow where (dest_port == "445" and protocol == "smb.write")
smb_write.file_name = smb_write.proto_info.file_name
output smb_write

An adversary needs to gain access to other hosts to move throughout an environment. In many cases, this is a twofold process. First, a file is remotely written to a host via an SMB share (detected by CAR-2013-05-003). Then, a variety of Execution techniques can be used to remotely establish execution of the file or script. To detect this behavior, look for files that are written to a host over SMB and then later run directly as a process or in the command line arguments. SMB File Writes and Remote Execution may happen normally in an environment, but the combination of the two behaviors is less frequent and more likely to indicate adversarial activity.

TypeTTPCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-IPCTA	IPC Traffic Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	image_path
process	create	proto_info
process	create	hostname

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

process = search Process:Create
smb_write = run Analytic:CAR-2013-05-003
remote_start = join (smb_write, process) where (
 smb_write.hostname == process.hostname and
 smb_write.file_path == process.image_path
 (smb_write.time < process.time)
)
output remote_start

Microsoft Windows uses its implementation of Distributed Computing Environment/Remote Procedure Call (DCE/RPC), which it calls Microsoft RPC, to call certain APIs remotely.

TypesTTP, Situational AwarenessCoverageModerateSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-RTA	RPC Traffic Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	start	dest_port
flow	start	src_port

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Traffic to the RPC Endpoint Mapper will always have the destination port of 135. Assuming success, RPC traffic will continue to the endpoint. The endpoint and the client both bind to dynamically assigned ports (on Windows, this is typically greater than 49152). The traffic between the client and endpoint can be detected by looking at traffic to 135 followed by traffic where the source and destination ports are at least 49152.

flows = search Flow:Start
rpc_mapper = filter flows where (dest_port == 135)
rpc_endpoint = filter flows where (dest_port >= 49152 and src_port >= 49152)
rpc = join rpc_mapper, rpc_endpoint where (
 (rpc_mapper.time < rpc_endpoint.time < rpc_mapper.time + 2 seconds) and
 (rpc_mapper.src_ip == rpc_endpoint.src_ip and rpc_mapper.dest_ip == rpc_endpoint.dest_ip)
)
output rpc

Tests4Executorscmd 3 · PowerShell 1Need elevation2 of 4Have prerequisites1Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Map admin share

windows

cmd

—

Connecting To Remote Shares

Input arguments

Name	Type	Default	Description
password	string	P@ssw0rd1	Password
user_name	string	DOMAIN\Administrator	Username
share_name	string	C$	Examples C$, IPC$, Admin$
computer_name	string	Target	Target Computer Name

Attack command

cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"

GUID5a8682e2-beb3-481b-b679-4abdc7c536d3

Map Admin Share PowerShell

windows

PowerShell

—

Map Admin share utilizing PowerShell

Input arguments

Name	Type	Default	Description
map_name	string	g	Mapped Drive Letter
share_name	string	C$	Examples C$, IPC$, Admin$
computer_name	string	Target	Target Computer Name

Attack command

New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}

GUID1182c2b0-494f-4fae-a327-7b4564b6a04e

Copy and Execute File with PsExec

windows

cmd

Required

—

Copies a file to a remote host and executes it using PsExec. Requires the download of PsExec from https://docs.microsoft.com/en-us/sysinternals/downloads/psexec.

Input arguments

Name	Type	Default	Description
psexec_exe	string	PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe	Path to PsExec
remote_host	string	\\localhost	Remote computer to receive the copy and execute the file
command_path	path	C:\Windows\System32\cmd.exe	File to copy and execute

Attack command

"#{psexec_exe}" #{remote_host} -accepteula -c #{command_path}

Prerequisite

PsExec tool from Sysinternals must exist on disk at specified location (#{psexec_exe})

Check

if (Test-Path "#{psexec_exe}") { exit 0} else { exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://download.sysinternals.com/files/PSTools.zip" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip"
Expand-Archive "PathToAtomicsFolder\..\ExternalPayloads\PsTools.zip" "PathToAtomicsFolder\..\ExternalPayloads\PsTools" -Force
New-Item -ItemType Directory (Split-Path "#{psexec_exe}") -Force | Out-Null
Copy-Item "PathToAtomicsFolder\..\ExternalPayloads\PsTools\PsExec.exe" "#{psexec_exe}" -Force

GUIDa87d3c9c-6db3-4416-9637-9b06672760fd

Execute command writing output to local Admin Share

windows

cmd

Required

—

Executes a command, writing the output to a local Admin Share. This technique is used by post-exploitation frameworks.

Input arguments

Name	Type	Default	Description
output_file	string	output.txt	Remote computer to receive the copy and execute the file
command_to_execute	string	hostname	Command to execute for output.

Attack command

cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file} 2>&1

GUIDce68006c-7098-40cd-b134-219ac04e6981

Tests from Atomic Red Team (MIT licence) · technique definition

SMB/Windows Admin Shares detections T1021.002

54 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 4%of all ATT&CK techniques for number of rules

Product

(none) 1

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs