indicatorregistry_key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\AutoShareWks
- First seen
- 2026-05-13
- Last seen
- 2026-05-13
- Sightings
- 1
Posts referencing this indicator
- Proactive Preparation and Hardening Against Destructive Attacks: 2026 Edition
Registry key controlling default administrative shares (e.g., C$, ADMIN$). Disabling this prevents lateral movement via hidden shares.