Data from Network Shared Drive

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

ID: T1039
Sub-techniques:  No sub-techniques
Tactic: Collection
Platforms: Linux, Windows, macOS
System Requirements: Privileges to access network shared drive
Contributors: David Tayouri
Version: 1.4
Created: 31 May 2017
Last Modified: 11 August 2023

Procedure Examples

ID Name Description
G0007 APT28

APT28 has collected files from network shared drives.[1]

S0128 BADNEWS

When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.[2]

G0060 BRONZE BUTLER

BRONZE BUTLER has exfiltrated files stolen from file shares.[3]

C0015 C0015

During C0015, the threat actors collected files from network shared drives prior to network encryption.[4]

G0114 Chimera

Chimera has collected data of interest from network shares.[5]

S0050 CosmicDuke

CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.[6]

S0554 Egregor

Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.[7]

G0117 Fox Kitten

Fox Kitten has searched network shares to access sensitive documents.[8]

G0047 Gamaredon Group

Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.[9]

G0045 menuPass

menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.[10]

S0458 Ramsay

Ramsay can collect data from network drives and stage it for exfiltration.[11]

G0054 Sowbug

Sowbug extracted Word documents from a file server on a victim network.[12]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments for actions that could be taken to collect files from a network share. Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location. Data may also be acquired and staged through Windows system management tools such as Windows Management Instrumentation and PowerShell.

DS0022 File File Access

Monitor for unexpected files (i.e. .pdf, .docx, .jpg, etc.) interacting with network shares.

DS0033 Network Share Network Share Access

Monitor for unexpected and abnormal accesses to network shares.

DS0029 Network Traffic Network Connection Creation

Monitor for newly constructed network connections that may search network shares on computers they have compromised to find files of interest. Network Analysis frameworks such as Zeek can be used to capture, decode, and alert on network protocols such as SMB that revolve around network shares.

Network Traffic Content

Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).

Network Traffic Flow

Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Network Analysis frameworks such as Zeek can be used to capture, decode, and alert on network protocols such as SMB that revolve around network shares. Although there may be more native ways to detect detailed SMB events on the host, they can be extracted out of network traffic. With the right protocol decoders, port 445 traffic can be filtered and even the file path (relative to the share) can be retrieved.

Looking at this activity more closely to obtain an adequate sense of situational awareness may make it possible to detect adversaries moving between hosts in a way that deviates from normal activity. Because SMB traffic is heavy in many environments, this analytic may be difficult to turn into something that can be used to quickly detect an APT. In some cases, it may make more sense to run this analytic in a forensic fashion. Looking through and filtering its output after an intrusion has been discovered may be helpful in identifying the scope of compromise.

Analytic 1 - SMB Events Monitoring

smb_events = filter flow where (dest_port == "445" and protocol == "smb")smb_events.file_name = smb_events.proto_info.file_name

References