Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
| ID | Name | Description |
|---|---|---|
| G0007 | APT28 | |
| S0128 | BADNEWS |
When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.[2] |
| G0060 | BRONZE BUTLER |
BRONZE BUTLER has exfiltrated files stolen from file shares.[3] |
| C0015 | C0015 |
During C0015, the threat actors collected files from network shared drives prior to network encryption.[4] |
| G0114 | Chimera |
Chimera has collected data of interest from network shares.[5] |
| S0050 | CosmicDuke |
CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.[6] |
| S0554 | Egregor |
Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.[7] |
| G0117 | Fox Kitten |
Fox Kitten has searched network shares to access sensitive documents.[8] |
| G0047 | Gamaredon Group |
Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.[9][10] |
| G0045 | menuPass |
menuPass has collected data from remote systems by mounting network shares with |
| S0458 | Ramsay |
Ramsay can collect data from network drives and stage it for exfiltration.[12] |
| G1039 | RedCurl | |
| G0054 | Sowbug |
Sowbug extracted Word documents from a file server on a victim network.[15] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0410 | Detection Strategy for Data from Network Shared Drive | AN1145 |
Monitoring of file access to network shares (e.g., C$, Admin$) followed by unusual read or copy operations by processes not typically associated with such activity (e.g., PowerShell, certutil). |
| AN1146 |
Unusual access or copying of files from mounted network drives (e.g., NFS, CIFS/SMB) by user shells or scripts followed by large data transfer. |
||
| AN1147 |
Detection of file access from mounted SMB shares followed by copy or exfil commands from Terminal or script interpreter processes. |