An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.
Description
Attack Execution Flow
4
1
Step 1
Explore[Acquire known Windows administrator credentials] The adversary must obtain known Windows administrator credentials in order to access the administrative network shares.
An adversary purchases breached Windows administrator credentials from the dark web.
An adversary leverages a key logger or phishing attack to steal administrator credentials as they are provided.
An adversary conducts a sniffing attack to steal Windows administrator credentials as they are transmitted.
An adversary gains access to a Windows domain system/files and exfiltrates Windows administrator password hashes.
An adversary examines outward-facing configuration and properties files to discover hardcoded Windows administrator credentials.
AI Translation
[Acquisizione di credenziali amministratore Windows note] L'avversario deve ottenere credenziali amministratore Windows note per accedere alle condivisioni di rete amministrative.
Un avversario acquista credenziali amministratore Windows compromesse dal dark web.
Un avversario sfrutta un key logger o un attacco di phishing per rubare le credenziali di amministratore mentre vengono fornite.
Un avversario conduce un attacco di sniffing per rubare le credenziali di amministratore Windows durante la trasmissione.
Un avversario ottiene accesso a un sistema/file di dominio Windows e esfiltra gli hash delle password di amministratore Windows.
Un avversario esamina i file di configurazione e proprietà rivolti verso l'esterno per scoprire credenziali di amministratore Windows hardcoded.
Attack Techniques
-
An adversary gains access to a Windows domain system/files and exfiltrates Windows administrator password hashes.
-
An adversary purchases breached Windows administrator credentials from the dark web.IT: Un avversario ottiene l'accesso a un sistema/file di dominio Windows e esfiltra gli hash delle password degli amministratori Windows.
-
An adversary leverages a key logger or phishing attack to steal administrator credentials as they are provided.IT: Un avversario ottiene l'accesso a un sistema/file di dominio Windows e esfiltra gli hash delle password degli amministratori Windows.
-
An adversary conducts a sniffing attack to steal Windows administrator credentials as they are transmitted.IT: Un avversario ottiene l'accesso a un sistema/file di dominio Windows e esfiltra gli hash delle password degli amministratori Windows.
-
An adversary examines outward-facing configuration and properties files to discover hardcoded Windows administrator credentials.IT: Un avversario ottiene l'accesso a un sistema/file di dominio Windows e esfiltra gli hash delle password degli amministratori Windows.
2
Step 2
Experiment[Attempt domain authentication] Try each Windows administrator credential against the hidden network shares until the target grants access.
Manually or automatically enter each administrator credential through the target's interface.
AI Translation
[Prova di autenticazione del dominio] Prova ogni credenziale di amministratore Windows contro le condivisioni di rete nascoste finché il target non concede l'accesso.
Inserisci manualmente o automaticamente ogni credenziale di amministratore tramite l'interfaccia del target.
Attack Techniques
-
Manually or automatically enter each administrator credential through the target's interface.
3
Step 3
Exploit[Malware Execution] An adversary can remotely execute malware within the administrative network shares to infect other systems within the domain.
AI Translation
[Esecuzione di malware] Un avversario può eseguire remotamente malware all'interno delle condivisioni di rete amministrative per infettare altri sistemi all'interno del dominio.
4
Step 4
Exploit[Data Exfiltration] The adversary can remotely obtain sensitive data contained within the administrative network shares.
AI Translation
[Data Exfiltration] L'avversario può ottenere da remoto dati sensibili contenuti nelle condivisioni di rete amministrative.
Mitigations
3
Deny Remote Use Of Local Admin Credentials To Log Into Domain Systems.
Do Not Allow Accounts To Be A Local Administrator On More Than One System.
Do Not Reuse Local Administrator Account Credentials Across Systems.
Consequences
Security Scopes Affected
Access Control
Authentication
Authorization
Confidentiality
Integrity
Potential Impacts
Gain Privileges
Modify Data
Read Data
Indicators
3
Data is being transferred and/or removed from administrative network shares.
Suspicious or Malicious software is executed within administrative network shares.
Suspicious or Malicious software is downloaded/installed on systems within the domain.
Relationships
Parent CAPECs
Related ATT&CK Techniques
1
T1021.002
SMB/Windows Admin Shares
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may …
Resources Required
1
A list of known Windows administrator credentials for the targeted domain.