CAPEC-561: Windows Admin Shares with Stolen Credentials

MITRE CAPEC attack pattern

Description

An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-262, CWE-263, CWE-294, CWE-308, CWE-309, CWE-521, CWE-522

ATT&CK techniques: T1021.002

Prerequisites

• The system/application is connected to the Windows domain.
• The target administrative share allows remote use of local admin credentials to log into domain systems.
• The adversary possesses a list of known Windows administrator credentials that exist on the target domain.

Skills required

• Low: Once an adversary obtains a known Windows credential, leveraging it is trivial.

Consequences

• Confidentiality, Access Control, Authentication: Gain Privileges
• Confidentiality, Authorization: Read Data
• Integrity: Modify Data

Mitigations

• Do not reuse local administrator account credentials across systems.
• Deny remote use of local admin credentials to log into domain systems.
• Do not allow accounts to be a local administrator on more than one system.

Source

• MITRE CAPEC CAPEC-561