How Attackers Use Windows Administrative Shares to Spread Malware
Summary
The article explains how Emotet and Trickbot can use stolen or brute-forced credentials and Windows administrative shares to spread across networks, and recommends limiting administrative access and SMB exposure.
Key points
- Windows administrative shares are hidden from ordinary network browsing but can be discovered with Windows commands or SMB clients.
- Access to administrative shares requires administrative privileges, which attackers or malware can use for lateral movement.
- The article says Emotet and Trickbot can steal or brute-force credentials, then use a PsExec-like method to copy and execute payloads on remote hosts.
- Unrestricted internal SMB traffic and reused administrator credentials can expose multiple systems to the same compromise.
- Recommended safeguards include randomizing local administrator passwords, auditing and limiting privileged accounts, and disabling administrative shares or blocking SMB access where appropriate.
Article Details
- Defense Focus
- Reduce malware propagation through Windows administrative shares by limiting administrative access and restricting SMB access between hosts.
- Platforms
- Windows
- Defensive Actions
- Randomize local administrator passwords on hosts using Local Administrator Password Solution (LAPS).
- Regularly audit accounts with administrative privileges and limit access to users who require it.
- On hosts that do not need to share resources with other systems, consider disabling administrative shares or using the local firewall to block SMB ports.
MITRE ATT&CK
T1021.002 · SMB/Windows Admin SharesThe article describes malware using Windows administrative shares over SMB to access remote hosts and propagate.T1105 · Ingress Tool TransferThe article says Emotet and Trickbot copy malicious payloads to remote victim hosts through administrative shares.T1110.001 · Password GuessingThe article says Emotet and Trickbot use brute force to gain access to other systems on the network.
People
Malware
EmotetThe Huntress SOC team continues to see new Emotet, Trickbot, and Qakbot malware outbreaks within networks — regardless of antivirus, anti-spam, or firewall solutions. As a result, we’ve become too familiar with theQakbotThe Huntress SOC team continues to see new Emotet, Trickbot, and Qakbot malware outbreaks within networks — regardless of antivirus, anti-spam, or firewall solutions. As a result, we’ve become too familiar with theTrickBotThe Huntress SOC team continues to see new Emotet, Trickbot, and Qakbot malware outbreaks within networks — regardless of antivirus, anti-spam, or firewall solutions. As a result, we’ve become too familiar with the