Detecting Device Share Enabled on Systems

Device sharing allows folders or administrative shares (like C$, IPC$, ADMIN$) to be accessed remotely over a network. While useful for system administration, in enterprise environments it may:

• Expose sensitive resources to unauthorized access if not properly controlled.

• Increase the attack surface for malware or lateral movement.

• Conflict with security and compliance requirements if left unrestricted.

The Saner CVEM platform helps administrators detect, analyze, and control device shares across managed systems.

1. Detecting Device Share Status

Saner CVEM continuously scans endpoints and generates Posture Anomalies when device sharing is enabled.

Steps to Detect:

1. Navigate to the Posture Anomaly (PA) Dashboard.

2. Locate the anomaly PA-2022-1075 – Device Share is enabled.
   

   • This triggers when administrative or default shares are active.
     
     

3. Review the Summary Section:

   • OS family with the most anomalies (e.g., Windows).

   • Group with the most anomalies (e.g., New Custom Group).

   • Operating System version with the highest anomalies (e.g., Microsoft Windows 11).
     
     

4. Check Posture Anomaly by Device:

   • Lists hostnames and number of anomalies detected.

   • Example: node-1 (Windows family) – 3 anomalies.
     
     

5. Review Posture Anomaly by Incidence:

   • Displays active network shares.

   • Example:

     • ADMIN$ – 1 device

     • C$ – 1 device

     • IPC$ – 1 device

6. Use Group, Family, OS dashboards for a clear visualization of affected devices.

2. Investigating the Risk

Once anomalies are detected:

• Check if the shares are intentionally enabled (for IT/admin use) or left open unnecessarily.

• Assess whether the shares are restricted by permissions or broadly exposed.

• Cross-check against compliance/security guidelines to decide if remediation is required.