Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Lateral Movement/ T1021.002

T1021.002SMB/Windows Admin Shares

T1021.002 — SMB/Windows Admin Shares is a MITRE ATT&CK technique in the Lateral Movement tactic. Clankerusecase tracks 15 detection use cases covering it and 134 threat-intel articles citing it.

Lateral Movement
View on the matrix → Filter Detection Library MITRE official spec ↗
15Use cases
134Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1021 · Remote Services

Use cases covering this technique (15)

Remote service execution — PsExec / SMB lateral movement Internal actions · alerting DSΣP Detect PsExec With accepteula Flag ESCU actions · alerting P Executable File Written in Administrative SMB Share ESCU actions · alerting P Impacket Lateral Movement Commandline Parameters ESCU actions · alerting P Impacket Lateral Movement smbexec CommandLine Parameters ESCU actions · alerting P Impacket Lateral Movement WMIExec Commandline Parameters ESCU actions · alerting P Windows PUA Named Pipe ESCU actions · hunting P Windows RMM Named Pipe ESCU actions · hunting P Windows Special Privileged Logon On Multiple Hosts ESCU actions · alerting P Windows Suspicious C2 Named Pipe ESCU actions · alerting P Windows Suspicious Named Pipe ESCU actions · alerting P Windows Theme File Creation in Unusual Location ESCU actions · hunting P SMB Traffic Spike ESCU actions · hunting P SMB Traffic Spike - MLTK ESCU actions · hunting P [LLM] DynoWiper deployment from shared inetpub\pub directory (Sandworm, Poland Dec 2025) Bespoke install · alerting DSΣP

Articles citing this technique (134)

crit Chinese hackers hijack auth flow, spy on isolated network for a decade art-07
high Ukrainian national pleads guilty to role in Conti ransomware operation art-24
crit Rethinking MDR as Attackers and Defenders Embrace AI art-30
high CISA orders feds to patch actively exploited Ivanti flaw by Sunday art-34
high Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs art-36
crit ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities art-37
high A tale of two eras art-40
crit The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm art-44
crit Cybersecurity Stars Awards 2026: Winners Announced Across 95 Categories art-48
crit OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack art-53
crit OceanLotus: From external espionage to domestic targeting art-54
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-78
crit Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now art-84
crit Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models art-87
crit Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order art-101
crit UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign art-108
crit CISA KEV: CVE-2026-50751 — Check Point Security Gateway Improper Authentication Vulnerability art-111
crit Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign art-139
crit Containers on fire: from container escapes to supply chain attacks art-158
crit Malicious npm packages abuse dependency confusion to profile developer environments art-161
crit Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection art-178
high Typosquatted npm packages used to steal cloud and CI/CD secrets art-183
crit 2026 World Cup: Discussing The World’s Biggest Game’s Attack Surface art-187
crit ESET APT Activity Report Q4 2025–Q1 2026 art-189
crit [GHSA / CRITICAL] CVE-2026-46621: Yamcs Vulnerable to Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection art-191
crit Out of the Crypt: The Evolving Cyber Extortion Economy art-193
crit [GHSA / CRITICAL] CVE-2026-44632: Yamcs Vulnerable to Server-Side Code Injection (RCE) via Janino Expression Engine in `JavaExprAlgorithmExe art-202
crit CISA KEV: CVE-2026-48027 — Nx Console Embedded Malicious Code Vulnerability art-203
crit CISA KEV: CVE-2026-45321 — TanStack Unspecified Vulnerability art-204
crit Paved With Intent: ROADtools and Nation-State Tactics in the Cloud art-218
crit Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload art-219
crit Webworm: New burrowing techniques art-240
crit [GHSA / CRITICAL] CVE-2026-46339: 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes art-251
crit [GHSA / CRITICAL] CVE-2026-2587: GlassFish's gadget handler is vulnerable to RCE art-257
crit IT threat evolution in Q1 2026. Mobile statistics art-278
high The time of much patching is coming art-296
crit [GHSA / CRITICAL] CVE-2026-46442: FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape art-304
crit Kimsuky targets organizations with PebbleDash-based tools art-308
crit Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools art-316
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-318
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-322
crit Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution art-325
high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-334
crit CISA KEV: CVE-2026-41940 — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability art-344
crit CISA KEV: CVE-2024-1708 — ConnectWise ScreenConnect Path Traversal Vulnerability art-350
crit CISA KEV: CVE-2024-57728 — SimpleHelp Path Traversal Vulnerability art-358
crit CISA KEV: CVE-2024-57726 — SimpleHelp Missing Authorization Vulnerability art-359
crit fast16 | Mystery Shadow Brokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet art-360
crit What the ransom note won’t say art-370
crit CISA KEV: CVE-2023-27351 — PaperCut NG/MF Improper Authentication Vulnerability art-374
crit CISA KEV: CVE-2024-27199 — JetBrains TeamCity Relative Path Traversal Vulnerability art-378
crit CISA KEV: CVE-2023-21529 — Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability art-390
high Securing Vibe Coding and AI Coding Agents: An End-to-End Approach with StepSecurity art-395
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-401
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-408
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-420
crit litellm: Credential Stealer Hidden in PyPI Wheel art-423
high Trivy Compromised a Second Time - Malicious v0.69.4 Release, aquasecurity/setup-trivy, aquasecurity/trivy-action GitHub Actions Compromised art-430
med Cloud workload security: Mind the gaps art-442
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-443
high CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran art-444
crit EDR killers explained: Beyond the drivers art-455
crit CISA KEV: CVE-2026-20131 — Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management art-457
crit Cyber fallout from the Iran war: What to have on your radar art-474
crit Sednit reloaded: Back in the trenches art-477
crit How SMBs use threat research and MDR to build a defensive edge art-486
crit Protecting education: How MDR can tip the balance in favor of schools art-491
high PromptSpy ushers in the era of Android threats using GenAI art-519
crit CISA KEV: CVE-2024-7694 — TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability art-531
crit CISA KEV: CVE-2026-1731 — BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability art-543
crit Naming and shaming: How ransomware groups tighten the screws on victims art-544
crit CISA KEV: CVE-2026-24423 — SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability art-576
crit DynoWiper update: Technical analysis and attribution art-590
crit CISA KEV: CVE-2025-52691 — SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability art-599
crit CISA KEV: CVE-2026-23760 — SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability art-600
high ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025 art-603
crit Malicious PyPI Packages spellcheckpy and spellcheckerpy Deliver Python RAT art-608
high ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations art-624
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-642
crit ESET Threat Report H2 2025 art-647
high Sha1-Hulud: The Second Coming - Zapier, ENS Domains, and Other Prominent NPM Packages Compromised art-653
high Black Hat Europe 2025: Reputation matters – even in the ransomware economy art-660
crit CISA KEV: CVE-2025-55182 — Meta React Server Components Remote Code Execution Vulnerability art-670
high In memoriam: David Harley art-713
crit ESET APT Activity Report Q2 2025–Q3 2025 art-715
high Ground zero: 5 things to do after discovering a cyberattack art-722
high How MDR can give MSPs the edge in a competitive market art-730
crit CISA KEV: CVE-2025-33073 — Microsoft Windows SMB Client Improper Access Control Vulnerability art-742
crit CISA KEV: CVE-2025-61884 — Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability art-743
crit CISA KEV: CVE-2025-61882 — Oracle E-Business Suite Unspecified Vulnerability art-764
crit CISA KEV: CVE-2025-10035 — Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability art-773
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-789
crit CISA KEV: CVE-2025-49704 — Microsoft SharePoint Code Injection Vulnerability art-841
crit CISA KEV: CVE-2025-53770 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability art-844
crit CISA KEV: CVE-2025-5777 — Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability art-848
crit CISA KEV: CVE-2019-6693 — Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability art-860
high Finding Software Flaws Early in the Development Process Provides Clear ROI art-871
crit CISA KEV: CVE-2025-31324 — SAP NetWeaver Unrestricted File Upload Vulnerability art-923
crit CISA KEV: CVE-2025-29824 — Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability art-936
crit CISA KEV: CVE-2025-31161 — CrushFTP Authentication Bypass Vulnerability art-938
crit CISA KEV: CVE-2025-22457 — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability art-939
crit CISA KEV: CVE-2025-24472 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-956
crit CISA KEV: CVE-2025-26633 — Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability art-970
crit CISA KEV: CVE-2025-22225 — VMware ESXi Arbitrary Write Vulnerability art-978
crit CISA KEV: CVE-2018-8639 — Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability art-982
crit CISA KEV: CVE-2024-53704 — SonicWall SonicOS SSLVPN Improper Authentication Vulnerability art-998
crit CISA KEV: CVE-2024-57727 — SimpleHelp Path Traversal Vulnerability art-999
crit CISA KEV: CVE-2025-23006 — SonicWall SMA1000 Appliances Deserialization Vulnerability art-1021
crit CISA KEV: CVE-2024-55591 — Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability art-1032
crit CISA KEV: CVE-2023-48365 — Qlik Sense HTTP Tunneling Vulnerability art-1033
crit CISA KEV: CVE-2025-0282 — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability art-1037
crit CISA KEV: CVE-2024-55550 — Mitel MiCollab Path Traversal Vulnerability art-1039
crit CISA KEV: CVE-2024-55956 — Cleo Multiple Products Unauthenticated File Upload Vulnerability art-1051
crit CISA KEV: CVE-2024-50623 — Cleo Multiple Products Unrestricted File Upload Vulnerability art-1054
crit CISA KEV: CVE-2024-51378 — CyberPanel Incorrect Default Permissions Vulnerability art-1060
crit CISA KEV: CVE-2024-11667 — Zyxel Multiple Firewalls Path Traversal Vulnerability art-1063
crit CISA KEV: CVE-2023-28461 — Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability art-1069
crit CISA KEV: CVE-2024-9474 — Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability art-1078
med Understanding command injection vulnerabilities in Go art-1080
crit CISA KEV: CVE-2024-49039 — Microsoft Windows Task Scheduler Privilege Escalation Vulnerability art-1089
crit CISA KEV: CVE-2024-51567 — CyberPanel Incorrect Default Permissions Vulnerability art-1091
crit CISA KEV: CVE-2024-38094 — Microsoft SharePoint Deserialization Vulnerability art-1106
crit CISA KEV: CVE-2024-40711 — Veeam Backup and Replication Deserialization Vulnerability art-1111
crit CISA KEV: CVE-2024-9680 — Mozilla Firefox Use-After-Free Vulnerability art-1114
crit CISA KEV: CVE-2024-30088 — Microsoft Windows Kernel TOCTOU Race Condition Vulnerability art-1115
med Promise queues and batching concurrent tasks in Deno art-1136
crit CISA KEV: CVE-2024-6670 — Progress WhatsUp Gold SQL Injection Vulnerability art-1151
crit CISA KEV: CVE-2024-40766 — SonicWall SonicOS Improper Access Control Vulnerability art-1157
crit CISA KEV: CVE-2017-1000253 — Linux Kernel PIE Stack Buffer Corruption Vulnerability art-1158
crit CISA KEV: CVE-2024-23897 — Jenkins Command Line Interface (CLI) Path Traversal Vulnerability art-1177
crit CISA KEV: CVE-2024-37085 — VMware ESXi Authentication Bypass Vulnerability art-1197
crit CISA KEV: CVE-2024-26169 — Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability art-1230
crit CISA KEV: CVE-2024-4577 — PHP-CGI OS Command Injection Vulnerability art-1234
crit Snyk Learn and the NIST Cybersecurity Framework (CSF) art-1274