Default CIFS Shares

Windows creates several hidden administrative shares (names ending in $, which suppresses them from browse lists) on every SMB-enabled host. They are the backbone of remote administration — and of lateral movement. MITRE ATT&CK covers their abuse under T1021.002 — SMB/Windows Admin Shares. ^{1 2}

Share	Maps to	Default access
ADMIN$	%WINDIR% (e.g., C:\Windows)	Administrators only
C$	Root of the system drive (C:\)	Administrators only
IPC$	Named-pipe IPC endpoint (not a filesystem path)	Authenticated users (null session on legacy configs)

Operational significance

• ADMIN$ — writable for admins, lands files directly in the Windows directory. A classic drop point for malicious executables later triggered via sc.exe (see exploit-windows-services) or schtasks.exe.
• C$ — full read/write over the system drive for admins; used to stage tools, harvest files, and plant binaries anywhere on disk.
• IPC$ — the inter-process communication share. Required for the authentication handshake and named-pipe access that tools like psexec, impacket-psexec, and remote service control rely on. Enumerated with smbclient (-L), smbmap, and enum4linux.

You generally cannot connect to these shares without administrative credentials — the exception being IPC$, which historically allowed anonymous (null-session) access for user/share enumeration.

Defense

• Monitor file writes of executables into ADMIN$/C$ (see Red Canary detection guidance)
• Windows event 5140/5145 (network share access) captures admin-share connections — see windows-event-logs
• Disable administrative shares where operationally feasible (AutoShareServer/AutoShareWks registry values) — with caveats for management tooling

Sources

• MITRE ATT&CK T1021.002 — SMB/Windows Admin Shares
• SMB/Windows Admin Shares — Red Canary Threat Detection Report

Related: smbclient, smbmap, psexec, exploit-windows-services, ntlm-relay-attacks

Footnotes

1. MITRE ATT&CK T1021.002 — SMB/Windows Admin Shares ↩

2. SMB/Windows Admin Shares — Red Canary Threat Detection Report ↩