
Once again, and I cannot stress this enough, any attacker post exploitation is going to try to enumerate shares in your environment. You name a share secret or help desk, IT admin, any of these, those are the first shares an attacker is going to go to.