value:  Chimera has used Windows admin shares to move laterally. ;; Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement. ;; Conti can spread via SMB and encrypts files on different hosts potentially compromising an entire network. ;; Deep Panda uses net.exe to connect to network shares using net use commands with compromised credentials. ;; Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware. ;; Emotet leverages the Admin$ share for lateral movement once the local admin password has been brute forced.  ;; FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context. ;; Fox Kitten has used valid accounts to access SMB shares. ;; Ke3chang actors have been known to copy files to the network shares of other computers to move laterally. ;; Kwampirs copies itself over network shares to move laterally on a victim network. ;; Lazarus Group malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement. ;; Lucifer can infect victims by brute forcing SMB. ;; Lateral movement can be done with Net through net use commands to connect to the on remote systems. ;; Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement. ;; NotPetya can use PsExec which interacts with the ADMIN$ network share to execute commands on remote systems. ;; Olympic Destroyer uses PsExec to interact with the ADMIN$ network share to execute commands on remote systems. ;; Operation Wocao has used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally. ;; Orangeworm has copied its backdoor across open network shares including ADMIN$ C$WINDOWS D$WINDOWS and E$WINDOWS. ;; PsExec a tool that has been used by adversaries writes programs to the ADMIN$ network share to execute commands on remote systems. ;; The Regin malware platform can use Windows admin shares to move laterally. ;; Ryuk has used the C$ network share for lateral movement. ;; Shamoon accesses network share(s) enables share access to the target device copies an executable payload to the target system and uses a Scheduled Task/Job to execute the malware. ;; Threat Group-1314 actors mapped network drives using net use. ;; Turla used net use commands to connect to lateral systems within a network. ;; Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement. ;; zwShell has been copied over network shares to move laterally.;;BlackMatter ransomware, with stolen credentials, often uses SMB to access the active directory (AD) and perform host discovery. ;; Attackers often use CobaltStrike functionality, specifically named pipes, in combination with SMB for lateral movement within networks. ;; Net, a utility program in windows systems, is often used by APT groups synchronously with SMB to perform a variety of tasks on host machines such as discovery, lateral movement and system/network information gathering. 
name: Remote Services: Smb/Windows Admin Shares