Disable Administrative Share Creation at Startup

Description

Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system

Query · sigma

selection:
  TargetObject|contains: \Services\LanmanServer\Parameters\
  TargetObject|endswith:
  - \AutoShareWks
  - \AutoShareServer
  Details: DWORD (0x00000000)
condition: selection

Known false positives

  • Unknown
Raw source Disable Administrative Share Creation at Startup · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: Disable Administrative Share Creation at Startup
id: c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e
status: test
description: Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md#atomic-test-4---disable-administrative-share-creation-at-startup
author: frack113
date: 2022-01-16
modified: 2024-03-25
tags:
    - attack.stealth
    - attack.t1070.005
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Services\LanmanServer\Parameters\'
        TargetObject|endswith:
            - '\AutoShareWks'
            - '\AutoShareServer'
        Details: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_administrative_share/info.yml
simulation:
    - type: atomic-red-team
      name: Disable Administrative Share Creation at Startup
      technique: T1070.005
      atomic_guid: 99c657aa-ebeb-4179-a665-69288fdd12b8

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.