An SMB CREATE Request is the file open or create message sent over the Server Message Block protocol. It asks a file server to open, create, or truncate a file or named pipe, and it carries desired access, share mode, and create options that determine whether other clients can read, write, or delete the object.
What an SMB CREATE Request does
An SMB CREATE Request is the protocol message that asks a file server to open, create, or truncate a file or named pipe while also declaring the caller's desired access, sharing mode, and create options.
That combination makes the request more than a simple “open file” operation. It is the moment when the client proposes the rules for how the object may be used, and the server decides whether those rules are acceptable under its local policy, permissions, and current object state.
Why CREATE parameters matter to file-server behaviour
The important detail in an SMB CREATE Request is that access is negotiated through multiple fields at once. Desired access says what the client wants to do, share mode says what other clients may do concurrently, and create options influence how the server treats existence, overwrite, and other object-level behaviours.
Because these fields shape the server's decision, the same request can produce very different outcomes depending on whether the target already exists, whether another process has it open, and whether the server allows the requested combination of access and sharing semantics.
How SMB CREATE Requests affect concurrency and object semantics
In practice, CREATE handling is where SMB enforces much of the file access contract. A restrictive share mode can block later readers or writers, while a permissive one can allow concurrent use that changes consistency expectations for applications and users.
The request also applies to named pipes, which means it can govern access to IPC-style endpoints as well as ordinary files. That makes the message relevant not only to storage access, but also to how applications expose or consume server-side services through SMB.
What defenders and troubleshooters should look for
When SMB file operations behave unexpectedly, the CREATE Request is often the first place to inspect, because the mismatch usually lives in the requested access, share mode, or create disposition rather than in the later read or write operation.
For defenders, visibility into CREATE activity helps explain why access was granted, denied, or constrained, and it can reveal abnormal patterns such as repeated open attempts, aggressive overwrite behaviour, or unusual named-pipe access paths.
Risk and Threat Considerations
SMB CREATE semantics can create real exposure when applications, administrators, or attackers rely on permissive share modes or weak object handling. If the server accepts broad access and sharing combinations, an attacker with valid network reach may be able to interfere with files, observe concurrent use patterns, or gain a foothold through writable named pipes.
Failure mechanism: A hostile or over-privileged client issues CREATE requests with access and share settings that exploit weak file permissions, sloppy server-side validation, or overly permissive object semantics.
Impact: The result can include unauthorized file modification, truncation, denial of service through lock contention, unsafe concurrent access, or abuse of named-pipe endpoints that support further lateral movement or service manipulation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | SMB CREATE enforces requested access and sharing semantics on server-side objects. |
| AC-6 — Least Privilege | CREATE requests often expose overbroad access and share settings that should be minimized. | |
| SC-7 — Boundary Protection | SMB CREATE is a network-reachable file-service operation whose exposure depends on boundary controls. | |
| Recommendation — Enforce AC-3 so SMB servers approve only the access needed for each file or pipe open. Apply AC-6 to limit SMB object access to the minimum required by each caller. Use SC-7 to restrict SMB exposure and segment file services from untrusted networks. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | SMB sharing and object semantics depend on hardened service configuration. |
| Recommendation — Harden SMB service settings so share modes and file access behave predictably. | ||
| MITRE ATT&CK | T1021.002 — SMB/Windows Admin Shares | Attacks often abuse SMB file access and object operations for remote execution or movement. |
| Recommendation — Map suspicious SMB CREATE activity to ATT&CK T1021.002 and investigate lateral movement paths. | ||
Practitioner Guidance
Why practitioners should care: SMB CREATE is where many practical access failures first appear, because the server is making a policy decision about object creation, overwrite, and concurrent use. Reviewing failures at this layer often explains issues that would otherwise be misdiagnosed as generic “file access” problems.
What to watch for: Repeated access denials, unexpected truncation, and unusual share-mode combinations deserve attention, especially on servers that host sensitive shared data or named-pipe interfaces. Those patterns often indicate either a misconfigured client or a request path that is being abused.
Practitioner takeaway: Treat CREATE semantics as part of the security boundary, not just a transport detail, because the object-creation decision determines who can use the resource and under what concurrency rules.
Related resources from NHI Mgmt Group
- Why do oversized request bodies create a security risk in container platforms?
- Why do access request portals create governance risk if they are too easy to use?
- Why do access request workflows so often create overprivilege?
- Why do pull_request_target workflows create more risk than standard pull request workflows?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org