COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-561

Windows Admin Shares with Stolen Credentials

An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

Genişletilmiş açıklama

Windows systems within the Windows NT family contain hidden network shares that are only accessible to system administrators. These shares allow administrators to remotely access all disk volumes on a network-connected system and further allow for files to be copied, written, and executed, along with other administrative actions. Example network shares include: C$, ADMIN$ and IPC$. If an adversary is able to obtain legitimate Windows credentials, the hidden shares can be accessed remotely, via server message block (SMB) or the Net utility, to transfer files and execute code. It is also possible for adversaries to utilize NTLM hashes to access administrator shares on systems with certain configuration and patch levels.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

Explore

Acquire known Windows administrator credentials

The adversary must obtain known Windows administrator credentials in order to access the administrative network shares.

Kullanılan teknikler

An adversary purchases breached Windows administrator credentials from the dark web.
An adversary leverages a key logger or phishing attack to steal administrator credentials as they are provided.
An adversary conducts a sniffing attack to steal Windows administrator credentials as they are transmitted.
An adversary gains access to a Windows domain system/files and exfiltrates Windows administrator password hashes.
An adversary examines outward-facing configuration and properties files to discover hardcoded Windows administrator credentials.

Experiment

Attempt domain authentication

Try each Windows administrator credential against the hidden network shares until the target grants access.

Kullanılan teknikler

Manually or automatically enter each administrator credential through the target's interface.

Exploit

Malware Execution

An adversary can remotely execute malware within the administrative network shares to infect other systems within the domain.

Data Exfiltration

The adversary can remotely obtain sensitive data contained within the administrative network shares.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

The system/application is connected to the Windows domain.
The target administrative share allows remote use of local admin credentials to log into domain systems.
The adversary possesses a list of known Windows administrator credentials that exist on the target domain.

Gerekli beceri

Low: Once an adversary obtains a known Windows credential, leveraging it is trivial.

Gerekli kaynak

A list of known Windows administrator credentials for the targeted domain.

Tespit

Saldırının göstergeleri nelerdir?

Data is being transferred and/or removed from administrative network shares.

Suspicious or Malicious software is executed within administrative network shares.

Suspicious or Malicious software is downloaded/installed on systems within the domain.

Etki

Başarılı saldırı neye yol açar?

Gain Privileges

Etkilenen alanlar: Confidentiality, Access Control, Authentication

Read Data

Etkilenen alanlar: Confidentiality, Authorization

Modify Data

Etkilenen alanlar: Integrity

Savunma

Nasıl önlenir ve etkisi azaltılır?

Do not reuse local administrator account credentials across systems.

Deny remote use of local admin credentials to log into domain systems.

Do not allow accounts to be a local administrator on more than one system.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay

APT32 has leveraged Windows' built-in Net utility to use Windows Administrative Shares to copy and execute remote malware. [ REF-579 ]

Örnek olay 2Detay

In May 2017, APT15 laterally moved within a Windows domain via Windows Administrative Shares to copy files to and from compromised host systems. This further allowed for the remote execution of malware. [ REF-578 ]