Cybersecurity from Málaga · Networks, lures and threats

← Threats
MITRE ATT&CK technique · Lateral Movement

T1021.002 SMB/Windows Admin Shares

Sub-technique of T1021 Remote Services

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Sigma rules to hunt it

Showing 25 of 35.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.