{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1039","id":"T1039","name":"Data from Network Shared Drive","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1039","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"40fc87282048ffe623f8b24a4fc93651184fd975161d810a34ad36f0cabaf3d0","description":"Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.(Citation: Net Use)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1039","external_id":"T1039"},{"source_name":"Net Use","description":"Microsoft Ignite. (n.d.). Net Use. Retrieved September 2, 2026.","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/gg651155(v=ws.11)"},{"source_name":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","description":"NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0054","name":"Drive Access","page":"telemetry/DC0054/","kind":"attack_component","category":"Endpoint activity","description":"Access to a disk/drive device, including supported raw-read observations.","collection_focus":"For Windows raw reads, review Sysmon RawAccessRead (9); collect device path and process. Normal file I/O is a different source.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["device_path","process_id","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0054","collector":"illustrative-lab-collector","observation":{"device_path":"\\\\.\\PhysicalDrive2","process_id":4200,"action":"raw_read"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0102","name":"Network Share Access","page":"telemetry/DC0102/","kind":"attack_component","category":"Windows and directory audit","description":"Access to a network share or an object through that share.","collection_focus":"Enable Audit File Share / Detailed File Share on the lab file server; correlate share checks with file-system access and requesting host/account.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["share","relative_path","access","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0102","collector":"illustrative-lab-collector","observation":{"share":"\\\\lab-server\\demo","relative_path":"demo.txt","access":"read","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1039","id":"T1039","name":"Data from Network Shared Drive","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1039","technique_page":"techniques/enterprise/T1039/","page":"detections/enterprise/T1039/","status":"rule_source_available","counts":{"sigma":2,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"91c945bc-2ad1-4799-a591-4d00198a1215","title":"Suspicious Access to Sensitive File Extensions","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/91c945bc-2ad1-4799-a591-4d00198a1215.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_raccess_sensitive_fext.yml","author":"Samir Bousseaden","kind":"sigma"},{"id":"855bc8b5-2ae8-402e-a9ed-b889e6df1900","title":"Copy From Or To Admin Share Or Sysvol Folder","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/855bc8b5-2ae8-402e-a9ed-b889e6df1900.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_copy_lateral_movement.yml","author":"Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1039-1","technique_id":"T1039","title":"T1039 Data from Network Shared Drive","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#collection","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":153,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L153","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"3fd54e301c63cf6d31050186a19e9198bb7c08ff801001f777b1aff351ece3ef","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(network_share_file_reads BY user, 10m) >= threshold -> ALERT","log_sources":[{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Storage-System Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#131-storage-system-audit-logs"},{"title":"Network Flow Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#57-network-flow-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0410","name":"Detection Strategy for Data from Network Shared Drive","url":"https://attack.mitre.org/detectionstrategies/DET0410","stix_id":"x-mitre-detection-strategy--79eb1874-4762-461b-a748-df85e61f3216","relationship_id":"relationship--7141f45b-597e-48a6-9b27-f3f2730dad87","description":"","analytics":[{"id":"AN1145","name":"Analytic 1145","guidance":"Monitoring of file access to network shares (e.g., C$, Admin$) followed by unusual read or copy operations by processes not typically associated with such activity (e.g., PowerShell, certutil).","url":"https://attack.mitre.org/detectionstrategies/DET0410#AN1145","platforms":["Windows"],"tuning":[{"field":"ShareName","description":"Organizations may use custom share paths outside of default C$, Admin$, etc."},{"field":"ProcessName","description":"Common toolsets vary; defenders should tailor to unusual processes for their environment."},{"field":"TimeWindow","description":"Time of day and access duration may need to be tuned to reduce false positives."}],"log_sources":[{"component_id":"DC0102","component":"Network Share Access","name":"WinEventLog:Security","channel":"EventCode=5145","platforms":["Windows"],"analytic_id":"AN1145","source_url":"https://attack.mitre.org/detectionstrategies/DET0410#AN1145","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0102/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN1145","source_url":"https://attack.mitre.org/detectionstrategies/DET0410#AN1145","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"}]},{"id":"AN1146","name":"Analytic 1146","guidance":"Unusual access or copying of files from mounted network drives (e.g., NFS, CIFS/SMB) by user shells or scripts followed by large data transfer.","url":"https://attack.mitre.org/detectionstrategies/DET0410#AN1146","platforms":["Linux"],"tuning":[{"field":"MountPoint","description":"Organization-specific share mount paths may vary (/mnt/share1, /srv/data etc.)"},{"field":"UID","description":"May need to scope to service accounts or user ID patterns specific to enterprise policy."}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open,read","platforms":["Linux"],"analytic_id":"AN1146","source_url":"https://attack.mitre.org/detectionstrategies/DET0410#AN1146","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0054","component":"Drive Access","name":"linux:syslog","channel":"mount/umount or file copy logs","platforms":["Linux"],"analytic_id":"AN1146","source_url":"https://attack.mitre.org/detectionstrategies/DET0410#AN1146","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0054/"}]},{"id":"AN1147","name":"Analytic 1147","guidance":"Detection of file access from mounted SMB shares followed by copy or exfil commands from Terminal or script interpreter processes.","url":"https://attack.mitre.org/detectionstrategies/DET0410#AN1147","platforms":["macOS"],"tuning":[{"field":"ProcessPath","description":"Script interpreters may vary (e.g., zsh, bash, python, osascript)."},{"field":"SharePath","description":"Network drive mount points may differ across enterprises."}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"macos:unifiedlog","channel":"filesystem and process events","platforms":["macOS"],"analytic_id":"AN1147","source_url":"https://attack.mitre.org/detectionstrategies/DET0410#AN1147","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"},{"component_id":"DC0054","component":"Drive Access","name":"fs:fsusage","channel":"open/read/mount operations","platforms":["macOS"],"analytic_id":"AN1147","source_url":"https://attack.mitre.org/detectionstrategies/DET0410#AN1147","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0054/"}]}]}],"telemetry_references":[{"id":"DC0054","name":"Drive Access","tag":"Drive Access","page":"telemetry/DC0054/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0102","name":"Network Share Access","tag":"Network Share Access","page":"telemetry/DC0102/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0050","name":"CosmicDuke","url":"https://attack.mitre.org/software/S0050","kind":"malware","description":"[CosmicDuke](https://attack.mitre.org/software/S0050) steals user files from network shared drives with file extensions and keywords that match a predefined list.(Citation: F-Secure Cosmicduke)","relationship_id":"relationship--3e7c9978-4db1-4ee1-ae27-640acee5a543","references":[{"source_name":"F-Secure Cosmicduke","description":"F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.","url":"https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf"}]},{"id":"S0128","name":"BADNEWS","url":"https://attack.mitre.org/software/S0128","kind":"malware","description":"When it first starts, [BADNEWS](https://attack.mitre.org/software/S0128) crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.(Citation: Forcepoint Monsoon)","relationship_id":"relationship--6c9649b7-00c6-4503-a911-9e8b9086eac4","references":[{"source_name":"Forcepoint Monsoon","description":"Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) can collect data from network drives and stage it for exfiltration.(Citation: Eset Ramsay May 2020)\t","relationship_id":"relationship--6c692a16-22b8-42bb-9a6b-3c25a2714cf5","references":[{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) can collect any files found in the enumerated drivers before sending it to its C2 channel.(Citation: NHS Digital Egregor Nov 2020) ","relationship_id":"relationship--59c58c73-046c-4e01-9ced-8c049381fcd2","references":[{"source_name":"NHS Digital Egregor Nov 2020","description":"NHS Digital. (2020, November 26). Egregor Ransomware The RaaS successor to Maze. Retrieved December 29, 2020.","url":"https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has collected files from network shared drives.(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)","relationship_id":"relationship--41fd6ebb-4262-40f8-842e-ff583ff01500","references":[{"source_name":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","description":"NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"id":"G0045","name":"menuPass","url":"https://attack.mitre.org/groups/G0045","kind":"intrusion-set","description":"[menuPass](https://attack.mitre.org/groups/G0045) has collected data from remote systems by mounting network shares with <code>net use</code> and using Robocopy to transfer data.(Citation: PWC Cloud Hopper April 2017)","relationship_id":"relationship--c2909563-2b7e-48d6-b165-05b8eff63862","references":[{"source_name":"PWC Cloud Hopper April 2017","description":"PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017.","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) malware has collected Microsoft Office documents from mapped network drives.(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024) ","relationship_id":"relationship--4716b9ec-a0d4-47db-a901-5a3b67d9e096","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"ESET Gamaredon Sept2024","description":"Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"id":"G0054","name":"Sowbug","url":"https://attack.mitre.org/groups/G0054","kind":"intrusion-set","description":"[Sowbug](https://attack.mitre.org/groups/G0054) extracted Word documents from a file server on a victim network.(Citation: Symantec Sowbug Nov 2017)","relationship_id":"relationship--5f3eb1ae-782e-4e49-8e1e-650f3e5a1139","references":[{"source_name":"Symantec Sowbug Nov 2017","description":"Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"id":"G0060","name":"BRONZE BUTLER","url":"https://attack.mitre.org/groups/G0060","kind":"intrusion-set","description":"[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has exfiltrated files stolen from file shares.(Citation: Secureworks BRONZE BUTLER Oct 2017)","relationship_id":"relationship--595be2e7-9f2a-4d5a-b23d-8e4822ae6199","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","description":"Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has collected data of interest from network shares.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--acb0fd33-201c-481f-857d-429c3ef67015","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has searched network shares to access sensitive documents.(Citation: CISA AA20-259A Iran-Based Actor September 2020)","relationship_id":"relationship--d51c9d02-a701-4334-9dbc-bba6c128ba2b","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","description":"CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"id":"G1039","name":"RedCurl","url":"https://attack.mitre.org/groups/G1039","kind":"intrusion-set","description":"[RedCurl](https://attack.mitre.org/groups/G1039) has collected data about network drives.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)","relationship_id":"relationship--1fe3ccfb-2ed1-412f-af7e-c63821a5e434","references":[{"source_name":"group-ib_redcurl1","description":"Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","description":"Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has collected data from SMB shares within the victim network.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ","relationship_id":"relationship--78a5ebb3-2506-492e-8b50-83199b2510f1","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"mitigations":[],"candidates":[{"id":"6ed67921-1774-44ba-bac6-adb51ed60660","name":"Copy a sensitive File over Administrative share with copy","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1039/T1039.yaml","description":"Copy from sensitive File from the c$ of another LAN computer with copy cmd\nhttps://twitter.com/SBousseaden/status/1211636381086339073","inputs":{"remote":{"description":"Remote server name","type":"string","default":"127.0.0.1"},"share_file":{"description":"Remote Path to the file","type":"path","default":"Windows\\temp\\Easter_Bunny.password"},"local_file":{"description":"Local name","type":"string","default":"Easter_egg.password"}},"dependencies":[{"description":"Administrative share must exist on #{remote}\n"},{"description":"\"\\\\#{remote}\\C$\\#{share_file}\" must exist on #{remote}\n"}],"source_definition_sha256":"448f9396533ffd808af01551fc52d506c363eeb3549d1f305e390e7dbd5b4120"},{"id":"7762e120-5879-44ff-97f8-008b401b9a98","name":"Copy a sensitive File over Administrative share with Powershell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1039/T1039.yaml","description":"Copy from sensitive File from the c$ of another LAN computer with powershell\nhttps://twitter.com/SBousseaden/status/1211636381086339073","inputs":{"remote":{"description":"Remote server name","type":"string","default":"127.0.0.1"},"share_file":{"description":"Remote Path to the file","type":"path","default":"Windows\\temp\\Easter_Bunny.password"},"local_file":{"description":"Local name","type":"string","default":"Easter_egg.password"}},"dependencies":[{"description":"Administrative share must exist on #{remote}\n"},{"description":"\"\\\\#{remote}\\C$\\#{share_file}\" must exist on #{remote}\n"}],"source_definition_sha256":"90f0c0b78abdcd6985a921dc2c0a7c4c2b57cb9fce141d6f0161b4c3861ab911"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1039":"/ttp-simulation/techniques/enterprise/T1039/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1039","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0054","collector":"illustrative-lab-collector","observation":{"device_path":"\\\\.\\PhysicalDrive2","process_id":4200,"action":"raw_read"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0102","collector":"illustrative-lab-collector","observation":{"share":"\\\\lab-server\\demo","relative_path":"demo.txt","access":"read","source_ip":"192.0.2.10"}}]}}