+
+Review the reports and data insights to get a quick feel for the level of SMB share exposure in your environment.
+
+Reports
+The Scan, Computer, Share, and ACL summary sections will provide a summary of the results.
+
+
+Data Insights
+The Data Insights sections are intented to highlight natural data groupings that can help centralize and expedite remediation on scale in Active Directory environments.
+
+
+
+
+Review potentially excessive share ACL entry details in the associated HTML and CSV files.
+
+
+
+Review the definitions below to ensure you understand what was targeted and how privileges have been qualified as excessive.
+
+Excessive Privileges
+In the context of this report, excessive read and write share permissions have been defined as any network share ACL containing an explicit entry for the "Everyone", "Authenticated Users", "BUILTIN\Users", "Domain Users", or "Domain Computers" groups.
+All provide domain users access to the affected shares due to privilege inheritance.
+
+Please note that share permissions can be overruled by NTFS permissions. Also, be aware that testing excluded share names containing the following keywords: "print$", "prnproc$", "printer", "netlogon",and "sysvol".
+
+High Risk Shares
+
+In the context of this report, high risk shares have been defined as shares that provide unauthorized remote access to a system or application. By default, that includes wwwroot, inetpub, c$, and admin$ shares. However, additional exposures may exist that are not called out beyond that.
+
+
+
+
+Follow the guidance in the Exploit Share Access, Detect Share Access, and Prioritize Remediation sections.
+
+
+Collect SMB Share data and generate this HTML report by running
Invoke-HuntSMBShares.ps1 audit script.
+The command examples below can be used to identify potentially malicious share permissions.
+
+
From Domain System
+
+Invoke-HuntSMBShares -Threads 20 -RunSpaceTimeOut 10 -OutputDirectory c:\folder\
+
+
+
From Non-Domain System
+
+runas /netonly /user:domain\user PowerShell.exe
+Import-Module Invoke-HuntSMBShares.ps1
+Invoke-HuntSMBShares -Threads 20 -RunSpaceTimeOut 10 -OutputDirectory c:\folder\ -DomainController 10.1.1.1 -Username domain\user -Password password
+
+
+
The
PowerHuntShares audit script was run against the netspi.local domain to collect SMB Share data, generate this HTML summary report, and generate the associated csv files that detail potentially excessive share configurations.
@@ -5708,75 +6277,6 @@ The left menu can be used to find summary data, the scan summary is in the table