DetailedCAPEC-561
CAPEC-561: Windows Admin Shares with Stolen Credentials
Description
An adversary guesses or obtains (i.e. steals or purchases) legitimate Windows administrator credentials (e.g. userID/password) to access Windows Admin Shares on a local machine or within a Windows domain.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- Not rated by MITRE
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Subvert Access Control
Prerequisites
- The system/application is connected to the Windows domain.
- The target administrative share allows remote use of local admin credentials to log into domain systems.
- The adversary possesses a list of known Windows administrator credentials that exist on the target domain.
Skills required
- LowOnce an adversary obtains a known Windows credential, leveraging it is trivial.
Consequences
- ConfidentialityAccess ControlAuthentication
Gain Privileges
- ConfidentialityAuthorization
Read Data
- Integrity
Modify Data
Mitigations
- Do not reuse local administrator account credentials across systems.
- Deny remote use of local admin credentials to log into domain systems.
- Do not allow accounts to be a local administrator on more than one system.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-STSession Termination1 shared
- D3-CAAConnection Attempt Analysis1 shared
- D3-APCAApplication Protocol Command Analysis1 shared
- D3-CSPPClient-server Payload Profiling1 shared
- D3-NTCDNetwork Traffic Community Deviation1 shared
- D3-NTFNetwork Traffic Filtering1 shared
- D3-NTSANetwork Traffic Signature Analysis1 shared
- D3-PHDURAPer Host Download-Upload Ratio Analysis1 shared
- D3-PMADProtocol Metadata Anomaly Detection1 shared
- D3-RTSDRemote Terminal Session Detection1 shared
- D3-UGLPAUser Geolocation Logon Pattern Analysis1 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2013-07-002RDP Connection Detection1 shared
- CAR-2014-05-001RPC Activity1 shared
- CAR-2014-11-006Windows Remote Management (WinRM)1 shared
- CAR-2016-04-005Remote Desktop Logon1 shared
- CAR-2013-01-003SMB Events Monitoring1 shared
- CAR-2013-10-001User Login Activity Monitoring1 shared
- CAR-2014-11-004Remote PowerShell Sessions1 shared
- CAR-2013-05-003SMB Write Request1 shared
- CAR-2013-05-005SMB Copy and Execution1 shared
- CAR-2013-07-001Suspicious Arguments1 shared
- CAR-2013-04-002Quick execution of a series of suspicious commands1 shared