SpecterOps SO-CON 2025 – Hunting SMB Shares | Scott Sutherland

Abstract

Every hacker has a story about abusing SMB shares, but it’s an attack surface that cybersecurity teams still struggle to understand, manage, and defend. This presentation covers simple but effective data analysis techniques to identify, understand, attack, and remediate SMB shares in Active Directory environments. The session includes demos showcasing how these techniques can be applied using PowerShell, Neo4j, Cytoscape, and PowerHuntShares.