Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
File sharing over a Windows network occurs over the SMB protocol.   Net can be used to query a remote system for available shared drives using the
net view \\remotesystem command. It can also be used to query shared drives on the local system using
net share. For macOS, the
sharing -l command lists all shared points used for smb services.
APT32 used the
APT38 has enumerated network shares on a compromised host.
APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.
APT41 used the
Avaddon has enumerated shared folders and mapped volumes.
AvosLocker has enumerated shared drives on a compromised network.
Bad Rabbit enumerates open SMB shares on internal victim networks.
BitPaymer can search for network shares on the domain or workgroup using
BlackCat has the ability to discover network shares on compromised networks.
During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.
Chimera has used
Cobalt Strike can query shared drives on the local system.
Conti can enumerate remote open SMB network shares using
CrackMapExec can enumerate the shared folders and associated permissions for a targeted network.
Cuba can discover shared resources using the
DarkVishnya scanned the network for public shared folders.
DEATHRANSOM has the ability to use loop operations to enumerate network resources.
Diavol has a
Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.
FIVEHANDS can enumerate network shares and mounted drives on a network.
Flagpro has been used to execute
HELLOKITTY has the ability to enumerate network resources.
InvisiMole can gather network share information.
Kwampirs collects a list of network shares with the command
MURKYTOP has the capability to retrieve information about shares on remote hosts.
Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.
During Operation CuckooBees, the threat actors used the
During Operation Wocao, threat actors discovered network disks mounted to the system using netstat.
Pupy can list local and remote shared drives and folders over SMB.
QakBot can use
QuietSieve can identify and search networked drives for specific file name extensions.
Ramsay can scan for network drives which may contain documents for collection.
Royal can enumerate the shared resources of a given IP addresses using the API call
ShimRat can enumerate connected drives for infected host machines.
SILENTTRINITY can enumerate shares on a compromised host.
Sowbug listed remote shared drives that were accessible from a victim.
Stuxnet enumerates the directories of a network resource.
Tonto Team has used tools such as NBTscan to enumerate network shares.
TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.
Tropic Trooper used
WastedLocker can identify network adjacent and accessible drives.
WhisperGate can enumerate connected remote logical drives.
Wizard Spider has used the "net view" command to locate mapped network shares.
Zebrocy identifies network drives when they are added to victim systems.
|M1028||Operating System Configuration||
Enable Windows Group Policy "Do Not Allow Anonymous Enumeration of SAM Accounts and Shares" security setting to limit users who can enumerate network shares.
|ID||Data Source||Data Component||Detects|
Monitor executed commands and arguments that may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
|DS0009||Process||OS API Execution||
Monitor for API calls that may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
Monitor for newly executed processes that may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.