> Isn't it should have root/admin privieleges to do such thing? There are a lot of networks out there with fileshares configured far more permissively than the

> Isn't it should have root/admin privieleges to do such thing? There are a lot of networks out there with fileshares configured far more permissively than they should be. Additionally, if the malware infects a machine that has cached domain admin credentials stored on it, it can use those to authenticate to the rest of the network and own the entire domain. Yes, if best practice is followed, these tactics wouldn't work. Best practice is not always followed.