T1021.002 — SMB/Windows Admin Shares

Tactic: Lateral Movement · Platforms: Windows

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may…

Sub-technique of Remote Services (T1021).

Sigma detection rules (1)

T1021.002 Remote Services: SMB/Windows Admin Shares

title: "T1021.002 Remote Services: SMB/Windows Admin Shares"
id: ead02846-c72e-4105-aa3e-48e9cfc2f4dc
description: 'Detection of SMB Administrative Share Access (ADMIN$/C$/IPC$) via Windows Security auditing. (Retargeted from generic port-445 network_connection matching to Security Event ID 5140 network share object access.) Tune using: ShareName, TimeWindow, UserContext, ProcessList.'
references:
  - https://attack.mitre.org/techniques/T1021/002
author: Shahrukh Khan
date: 2026-02-19
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.002

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: 5140
    ShareName|endswith:
      - '\ADMIN
    
  


      - '\C
    
  


      - '\IPC
    
  



  filter_machine_accounts:
    SubjectUserName|endswith: '
    
  



  condition: selection and not filter_machine_accounts

falsepositives:
  - Legitimate remote administration and normal domain replication/authentication traffic; requires 'Audit Detailed File Share' auditing enabled.

level: medium

Related sub-techniques

Explore