Skip to content

Hide Navigation Hide TOC

Suspicious New-PSDrive to Admin Share (1c563233-030e-4a07-af8c-ee0490a66d3a)

Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Cluster A Galaxy A Cluster B Galaxy B Level
SMB/Windows Admin Shares - T1021.002 (4f9ca633-15c5-463c-9724-bdcd54fde541) Attack Pattern Suspicious New-PSDrive to Admin Share (1c563233-030e-4a07-af8c-ee0490a66d3a) Sigma-Rules 1
SMB/Windows Admin Shares - T1021.002 (4f9ca633-15c5-463c-9724-bdcd54fde541) Attack Pattern Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba) Attack Pattern 2