TA0008 · LATERAL MOVEMENT
SMB/Windows Admin Shares
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
Detect it with
Ensure that proper logging of accounts used to log into systems is turned on and centrally collected. Windows logging is able to collect success/failure for accounts that may be used to move laterally and can be collected using tools such as Windows Event Forwarding.
Why it matters on shift
SMB/Windows Admin Shares is one of the concrete ways adversaries achieve lateral movement. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After lateral movement, the next tactic is usually Collection. Search your telemetry for the transition before closing the ticket.
Kill-chain context