CmdID / Techniques / T1021
T1021.002 Remote Services: SMB/Windows Admin Shares
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). MITRE ATT&CK
1 program on CmdID 10 Sigma rules T1021.002 on attack.mitre.org
Part of
Programs for it
Sigma rules tagged with it
Command lines CmdID reads as it
Make sure an SMB share is available in the current console on the page for net
net use \\smb_shared_folder /USER:usernameIdentifyTo display a list of all user accounts for the local computer, run the following command on the page for net user
net userIdentifyTo display information about the user account TommyH, run the following command on the page for net user
net user tommyhIdentifyTo set the sign-in time from 8 AM to 5 PM for the username MikeD using 24-hour notation, run the following command on the page for net user
net user miked /time:M-F,08:00-17:00IdentifyTo set the sign-in time from 8 AM to 5 PM for MikeD using 12-hour notation, run the following command on the page for net user
net user miked /time:M-F,8AM-5PMIdentifyTo specify sign-in hours of 4 AM to 12 PM on Monday, 12 PM to 8 PM on Tuesday, and 8 AM to 5 PM Wednesday through Friday for username AnibalS, run the following command on the page for net user
net user anibals /time:M,4AM-12PM;T,12PM-8PM;W-F,8AM-5PMIdentifyCopy a mandatory snippet from a folder to a destination folder on the page for New-IseSnippet
$path = "$HOME\Documents\WindowsPowerShell\Snippets\Mandatory.Snippets.ps1xml"
$destination = "\\Server\Share"
Copy-Item -Path $path -Destination $destinationIdentifyAn example is here when CmdID’s reading of it names T1021.002: a Sigma rule it trips is tagged with it, or its abuse is documented as it.