AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

T1039 · collection · ATT&CK 20.0

Data from Network Shared Drive

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.(Citation: Net Use)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)

Open detection, hunting, mitigation, and evidence workspace

Detection logic

Monitor processes and command-line arguments for actions that could be taken to collect files from a network share. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Observed actors

APT28
G0007 menuPass
G0045 Gamaredon Group
G0047 Sowbug
G0054 BRONZE BUTLER
G0060 Chimera
G0114 Fox Kitten
G0117 RedCurl
G1039 NIMBUS MANTICORE
G1059

Correlated CTI and IR reports

Cyber Knowledge context

Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.

MITRE mitigations

No ATT&CK mitigation relationship is published for this technique. Apply risk-based controls and verify scope.

MITRE detection strategies and analytics

DET0410 · Detection Strategy for Data from Network Shared Drive

AN1145 · Analytic 1145 — Monitoring of file access to network shares (e.g., C$, Admin$) followed by unusual read or copy operations by processes not typically associated with such activity (e.g., PowerShell, certutil).
AN1146 · Analytic 1146 — Unusual access or copying of files from mounted network drives (e.g., NFS, CIFS/SMB) by user shells or scripts followed by large data transfer.
AN1147 · Analytic 1147 — Detection of file access from mounted SMB shares followed by copy or exfil commands from Terminal or script interpreter processes.

MITRE detection source

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research

Attack tools, simulations and detection rules

Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.

T1039 Data from Network Shared Drive simulation — Exact active technique ID
T1039 detection rules — Exact active technique ID; not actor-specific detector coverage