T1021.002 SMB/Windows Admin Shares — Attack Simulation

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Copy and Execute File with PsExec
windows automated command_prompt
Procedure 0eb03d41-79e4-4393-8e57-6344856be1cf; elevation required; cleanup not declared. Not executed or individually validated.
Map admin share
windows automated command_prompt
Procedure 3386975b-367a-4fbb-9d77-4dcf3639ffd3; elevation not declared required; cleanup not declared. Not executed or individually validated.
Map Admin Share PowerShell
windows automated powershell
Procedure 514e9cd7-9207-4882-98b1-c8f791bae3c5; elevation not declared required; cleanup not declared. Not executed or individually validated.
Execute command writing output to local Admin Share
windows automated command_prompt
Procedure d41aaab5-bdfe-431d-a3d5-c29e9136ff46; elevation required; cleanup not declared. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows lateral-movement isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation

can_simulate subtechnique source_mapped

Detection and collection

T1021.002 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.