SMB/Windows Admin Shares
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba. Windo...
BY SOURCE
PROCEDURES (37)
Auto-extracted: 6 detections for process creation monitoring
Auto-extracted: 4 detections for general monitoring
Auto-extracted: 4 detections for named pipe
Auto-extracted: 4 detections for lateral
Auto-extracted: 3 detections for dll hijack
Auto-extracted: 3 detections for remote
Auto-extracted: 3 detections for service
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for beacon
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for dll hijack
Auto-extracted: 2 detections for ransomware
Auto-extracted: 2 detections for ransomware
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for command and control
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for beacon
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for dll hijack
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for network connection monitoring
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for named pipe
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for authentication monitoring
Auto-extracted: 1 detections for exfiltrat