Skip to content

Hide Navigation Hide TOC

SMB Create Remote File Admin Share (b210394c-ba12-4f89-9117-44a2464b9511)

Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

Cluster A Galaxy A Cluster B Galaxy B Level
SMB/Windows Admin Shares - T1021.002 (4f9ca633-15c5-463c-9724-bdcd54fde541) Attack Pattern SMB Create Remote File Admin Share (b210394c-ba12-4f89-9117-44a2464b9511) Sigma-Rules 1
SMB/Windows Admin Shares - T1021.002 (4f9ca633-15c5-463c-9724-bdcd54fde541) Attack Pattern Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba) Attack Pattern 2