T1021.002sub-technique of T1021 Remote Services
SMB/Windows Admin Shares
Windows5 pieces on this siteT1021.002 on attack.mitre.org
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Ransomware response plan: from the first renamed file to the review
The whole response rather than the first hour of it: who decides what, how to contain without destroying the evidence you will need, what has to be true before you restore, and the notifications whose clocks started before you noticed.
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: a service that existed for nine seconds
Remote execution over the admin share, reconstructed from the target. Tie four events in three logs into one action, work back to the host it came from, and handle the version where the service is not called PSEXESVC.
Seventeen hours at Calderbrook: from a password spray to data leaving
A constructed intrusion laid out against the clock and the ATT&CK tactics, following the same four stages as the guided labs. Eleven events, one of them inferred, and one tactic conspicuously missing.
A domain admin logon from a workstation that has never had one
Twenty minutes. Is this lateral movement, a misconfiguration, or a backup job nobody documented? Name the three pieces of evidence that would settle it, and say what you would do if you could not get any of them.
Read
Analyses, case studies, guides, references and interview questions.
Incident report: Kesterline Components, 8 May 2026
A full DFIR report on a constructed ransomware incident, written the way one gets handed to a board. Three hours twenty from first execution to encryption, four separate points where it could have been stopped, and the write-up that follows.
how MITRE says to see it
Multi-Event Detection for SMB Admin Share Lateral Movement
- An SMB-based remote file share access followed by lateral movement actions such as remote service creation, task scheduling, or suspicious process execution on the target host using ADMIN$ or C$ shares.
what reduces it
- M1035 Limit Access to Resource Over Network. Consider disabling Windows administrative shares.
- M1037 Filter Network Traffic. Consider using the host firewall to restrict file sharing communications such as SMB.
- M1027 Password Policies. Do not reuse local administrator account passwords across systems. Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed.
- M1026 Privileged Account Management. Deny remote use of local admin credentials to log into systems. Do not allow domain user accounts to be in the local Administrators group multiple systems.