{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1135","id":"T1135","name":"Network Share Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1135","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"a1674c15c04075cd7789c66ae0eb5591a01a38a0f215f77e49f6e281e7de7428","description":"Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. \n\nFile sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the <code>net view \\\\\\\\remotesystem</code> command. It can also be used to query shared drives on the local system using <code>net share</code>. For macOS, the <code>sharing -l</code> command lists all shared points used for smb services.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1135","external_id":"T1135"},{"source_name":"TechNet Shared Folder","description":"Microsoft. (n.d.). Share a Folder or Drive. Retrieved June 30, 2017.","url":"https://technet.microsoft.com/library/cc770880.aspx"},{"source_name":"Wikipedia Shared Resource","description":"Wikipedia. (2017, April 15). Shared resource. Retrieved June 30, 2017.","url":"https://en.wikipedia.org/wiki/Shared_resource"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0048","name":"Named Pipe Metadata","page":"telemetry/DC0048/","kind":"attack_component","category":"Endpoint activity","description":"Metadata about a named pipe and its creation or connection.","collection_focus":"Collect Sysmon PipeEvent 17–18 with pipe name and owning/connecting process; pipe contents require other instrumentation.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["pipe_name","action","process_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0048","collector":"illustrative-lab-collector","observation":{"pipe_name":"\\\\.\\pipe\\lab-demo","action":"connect","process_id":4200}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1135","id":"T1135","name":"Network Share Discovery","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1135","technique_page":"techniques/enterprise/T1135/","page":"detections/enterprise/T1135/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"c3d76afc-93df-461e-8e67-9b2bad3f2ac4","title":"File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/c3d76afc-93df-461e-8e67-9b2bad3f2ac4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary.yml","author":"@Kostastsale","kind":"sigma"},{"id":"b2317cfa-4a47-4ead-b3ff-297438c0bc2d","title":"HackTool - SharpView Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b2317cfa-4a47-4ead-b3ff-297438c0bc2d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml","author":"frack113","kind":"sigma"},{"id":"bef37fa2-f205-4a7b-b484-0759bfd5f86f","title":"PUA - Advanced IP Scanner Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/bef37fa2-f205-4a7b-b484-0759bfd5f86f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml","author":"Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy","kind":"sigma"},{"id":"54773c5f-f1cc-4703-9126-2f797d96a69d","title":"PUA - Advanced Port Scanner Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/54773c5f-f1cc-4703-9126-2f797d96a69d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0182","name":"Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS","url":"https://attack.mitre.org/detectionstrategies/DET0182","stix_id":"x-mitre-detection-strategy--e7870b55-7420-444a-9751-99fb5fbf4cd9","relationship_id":"relationship--1170753c-b8d9-4bd8-a3d7-e09882b53897","description":"","analytics":[{"id":"AN0513","name":"Analytic 0513","guidance":"Process or script enumerates network shares via CLI (net view/net share, PowerShell Get-SmbShare/WMI) or OS APIs (NetShareEnum/ srvsvc.NetShareEnumAll RPC) → bursts of outbound SMB/RPC connections (445/139, \\\\host\\IPC$ / srvsvc) to many hosts inside a short window → optional follow-on file listing or copy operations.","url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0513","platforms":["Windows"],"tuning":[{"field":"BurstHostThreshold","description":"Minimum number of unique destination hosts over SMB within TimeWindow to treat as scanning (e.g., ≥5)."},{"field":"TimeWindow","description":"Correlation window between the discovery process start and SMB fan-out (default 10m)."},{"field":"AllowedDiscoveryAccounts","description":"Service/admin accounts legitimately running inventory scripts."},{"field":"PipeNameAllowList","description":"Pipes (e.g., \\PIPE\\spoolss) normally accessed by management agents; exclude from alerts."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN0513","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0513","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN0513","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0513","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0048","component":"Named Pipe Metadata","name":"WinEventLog:Sysmon","channel":"EventCode=17","platforms":["Windows"],"analytic_id":"AN0513","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0513","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0048/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN0513","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0513","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0021","component":"OS API Execution","name":"etw:Microsoft-Windows-RPC","channel":"rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes","platforms":["Windows"],"analytic_id":"AN0513","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0513","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]},{"id":"AN0514","name":"Analytic 0514","guidance":"CLI tools (smbclient -L, smbmap, rpcclient, nmblookup) or custom scripts enumerate SMB shares on many internal hosts → corresponding SMB connections (445/139) captured by Zeek/Netflow within a short window.","url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0514","platforms":["Linux"],"tuning":[{"field":"BurstHostThreshold","description":"Minimum unique hosts to flag (e.g., ≥5)."},{"field":"TimeWindow","description":"Correlation window between tool exec and SMB fan-out (default 10m)."},{"field":"ApprovedInventoryHosts","description":"IPs of vulnerability scanners or config mgmt systems."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb","platforms":["Linux"],"analytic_id":"AN0514","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0514","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Flow","channel":"connection: TCP connections to ports 139/445 to multiple hosts","platforms":["Linux"],"analytic_id":"AN0514","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0514","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0021","component":"OS API Execution","name":"NSM:Flow","channel":"smb_command: TreeConnectAndX to \\\\*\\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares","platforms":["Linux"],"analytic_id":"AN0514","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0514","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]},{"id":"AN0515","name":"Analytic 0515","guidance":"Use of native/mac tools (sharing -l, smbutil view, mount_smbfs) or scripts to enumerate SMB shares across many hosts, followed by outbound SMB connections observed in PF/Zeek logs.","url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0515","platforms":["macOS"],"tuning":[{"field":"BurstHostThreshold","description":"Minimum unique SMB destinations (e.g., ≥3–5 in smaller mac fleets)."},{"field":"TimeWindow","description":"Correlation window between exec and SMB connections (default 10m)."},{"field":"AllowedMgmtTools","description":"Jamf/IT scripts legitimately running smbutil/mount_smbfs."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC: Process execution of \"sharing -l\", \"smbutil view\", \"mount_smbfs\"","platforms":["macOS"],"analytic_id":"AN0515","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0515","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"Command line contains smbutil view //, mount_smbfs //","platforms":["macOS"],"analytic_id":"AN0515","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0515","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Firewall","channel":"Outbound connections to 139/445 to multiple destinations","platforms":["macOS"],"analytic_id":"AN0515","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0515","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"NSM:Flow","channel":"connection: SMB connections to multiple internal hosts","platforms":["macOS"],"analytic_id":"AN0515","source_url":"https://attack.mitre.org/detectionstrategies/DET0182#AN0515","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0048","name":"Named Pipe Metadata","tag":"Named Pipe Metadata","page":"telemetry/DC0048/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0039","name":"Net","page":"tools/S0039/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0039","name":"Net","page":"tools/S0039/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) has a module to enumerate network shares.(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: CIRCL PlugX March 2013)","relationship_id":"relationship--5e7460f8-9ea9-4aa4-b06e-15861b02d70e","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"CIRCL PlugX March 2013","description":"Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"}]},{"id":"S0039","name":"Net","url":"https://attack.mitre.org/software/S0039","kind":"tool","description":"The <code>net view \\\\remotesystem</code> and <code>net share</code> commands in [Net](https://attack.mitre.org/software/S0039) can be used to find shared drives and directories on remote and local systems respectively.(Citation: Savill 1999)","relationship_id":"relationship--3b5d1788-c59b-4e84-97b0-b109df608619","references":[{"source_name":"Savill 1999","description":"Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.","url":"https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can query shared drives on the local system.(Citation: Cobalt Strike TTPs Dec 2017)","relationship_id":"relationship--a106b02a-0a6a-493f-911c-a00576013004","references":[{"source_name":"Cobalt Strike TTPs Dec 2017","description":"Cobalt Strike. (2017, December 8). Tactics, Techniques, and Procedures. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210924171429/https://www.cobaltstrike.com/downloads/reports/tacticstechniquesandprocedures.pdf"}]},{"id":"S0165","name":"OSInfo","url":"https://attack.mitre.org/software/S0165","kind":"malware","description":"[OSInfo](https://attack.mitre.org/software/S0165) discovers shares on the network(Citation: Symantec Buckeye)","relationship_id":"relationship--d07f2da6-6497-414f-96c1-9dd60155b169","references":[{"source_name":"Symantec Buckeye","description":"Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"id":"S0192","name":"Pupy","url":"https://attack.mitre.org/software/S0192","kind":"tool","description":"[Pupy](https://attack.mitre.org/software/S0192) can list local and remote shared drives and folders over SMB.(Citation: GitHub Pupy)","relationship_id":"relationship--1ba0b437-e809-479c-a254-172e706c3615","references":[{"source_name":"GitHub Pupy","description":"Nicolas Verdier. (n.d.). Retrieved January 29, 2018.","url":"https://github.com/n1nj4sec/pupy"}]},{"id":"S0233","name":"MURKYTOP","url":"https://attack.mitre.org/software/S0233","kind":"malware","description":"[MURKYTOP](https://attack.mitre.org/software/S0233) has the capability to retrieve information about shares on remote hosts.(Citation: FireEye Periscope March 2018)","relationship_id":"relationship--cffbdd23-bf18-4bb9-bd50-dc74b69784e2","references":[{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"S0236","name":"Kwampirs","url":"https://attack.mitre.org/software/S0236","kind":"malware","description":"[Kwampirs](https://attack.mitre.org/software/S0236) collects a list of network shares with the command <code>net share</code>.(Citation: Symantec Orangeworm April 2018)","relationship_id":"relationship--2beb9f29-a94b-469a-870e-2e2072bf941c","references":[{"source_name":"Symantec Orangeworm April 2018","description":"Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}]},{"id":"S0250","name":"Koadic","url":"https://attack.mitre.org/software/S0250","kind":"tool","description":"[Koadic](https://attack.mitre.org/software/S0250) can scan local network for open SMB.(Citation: Github Koadic)","relationship_id":"relationship--f25505f6-dbd0-4d7b-8e8c-b3885f206cbf","references":[{"source_name":"Github Koadic","description":"Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.","url":"https://github.com/offsecginger/koadic"}]},{"id":"S0251","name":"Zebrocy","url":"https://attack.mitre.org/software/S0251","kind":"malware","description":"[Zebrocy](https://attack.mitre.org/software/S0251) identifies network drives when they are added to victim systems.(Citation: Securelist Sofacy Feb 2018)","relationship_id":"relationship--e27ebd5b-4ed3-4c04-96e3-026bd127ed64","references":[{"source_name":"Securelist Sofacy Feb 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018.","url":"https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can gather network share information.(Citation: ESET InvisiMole June 2018)","relationship_id":"relationship--e1d0ec8e-0970-4737-9605-1cf8a3ba1371","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.(Citation: ESET Trickbot Oct 2020)(Citation: Bitdefender Trickbot March 2020)","relationship_id":"relationship--7cbc6309-f5fb-41e5-901b-67f02f29a834","references":[{"source_name":"ESET Trickbot Oct 2020","description":"Boutin, J. (2020, October 12). ESET takes part in global operation to disrupt Trickbot. Retrieved March 15, 2021.","url":"https://www.welivesecurity.com/2020/10/12/eset-takes-part-global-operation-disrupt-trickbot/"},{"source_name":"Bitdefender Trickbot March 2020","description":"Tudorica, R., Maximciuc, A., Vatamanu, C. (2020, March 18). New TrickBot Module Bruteforces RDP Connections, Targets Select Telecommunication Services in US and Hong Kong. Retrieved March 15, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/316/Bitdefender-Whitepaper-TrickBot-en-EN-interactive.pdf"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) can find shared drives on the local system.(Citation: Github PowerShell Empire)","relationship_id":"relationship--6fa815b2-23dc-455f-b358-dacb4e30a073","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0365","name":"Olympic Destroyer","url":"https://attack.mitre.org/software/S0365","kind":"malware","description":"[Olympic Destroyer](https://attack.mitre.org/software/S0365) will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.(Citation: Talos Olympic Destroyer 2018)","relationship_id":"relationship--c72b2674-e757-4290-9275-cc08a12713be","references":[{"source_name":"Talos Olympic Destroyer 2018","description":"Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.","url":"https://blog.talosintelligence.com/2018/02/olympic-destroyer.html"}]},{"id":"S0367","name":"Emotet","url":"https://attack.mitre.org/software/S0367","kind":"malware","description":"[Emotet](https://attack.mitre.org/software/S0367) has enumerated non-hidden network shares using `WNetEnumResourceW`. (Citation: Binary Defense Emotes Wi-Fi Spreader)","relationship_id":"relationship--491dc622-fa43-4015-b24a-8ec8d8f5a376","references":[{"source_name":"Binary Defense Emotes Wi-Fi Spreader","description":"Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.","url":"https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/"}]},{"id":"S0444","name":"ShimRat","url":"https://attack.mitre.org/software/S0444","kind":"malware","description":"[ShimRat](https://attack.mitre.org/software/S0444) can enumerate connected drives for infected host machines.(Citation: FOX-IT May 2016 Mofang)","relationship_id":"relationship--d2ef2109-c65f-452b-bb5b-dd06d1b16602","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) can scan for network drives which may contain documents for collection.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)\t","relationship_id":"relationship--0428220b-eb98-45c3-a637-7da54b4496b4","references":[{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"},{"source_name":"Antiy CERT Ramsay April 2020","description":"Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.","url":"https://www.programmersought.com/article/62493896999/"}]},{"id":"S0483","name":"IcedID","url":"https://attack.mitre.org/software/S0483","kind":"malware","description":"[IcedID](https://attack.mitre.org/software/S0483) has used the `net view /all` command to show available shares.(Citation: DFIR_Quantum_Ransomware)","relationship_id":"relationship--ba575869-1ac0-4681-aee2-37ecd3e6fed5","references":[{"source_name":"DFIR_Quantum_Ransomware","description":"DFIR. (2022, April 25). Quantum Ransomware. Retrieved July 26, 2024.","url":"https://thedfirreport.com/2022/04/25/quantum-ransomware/"}]},{"id":"S0488","name":"CrackMapExec","url":"https://attack.mitre.org/software/S0488","kind":"tool","description":"[CrackMapExec](https://attack.mitre.org/software/S0488) can enumerate the shared folders and associated permissions for a targeted network.(Citation: CME Github September 2018)","relationship_id":"relationship--61d859c1-c6f4-4f5f-bc5f-032481dddbe4","references":[{"source_name":"CME Github September 2018","description":"byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can enumerate shared drives on the domain.(Citation: NCC Group Team9 June 2020)","relationship_id":"relationship--203108df-424d-4dfe-ac45-3cbd84c71615","references":[{"source_name":"NCC Group Team9 June 2020","description":"Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}]},{"id":"S0570","name":"BitPaymer","url":"https://attack.mitre.org/software/S0570","kind":"malware","description":"[BitPaymer](https://attack.mitre.org/software/S0570) can search for network shares on the domain or workgroup using <code>net view <host></code>.(Citation: Crowdstrike Indrik November 2018)","relationship_id":"relationship--6743c3f6-7f4f-40b3-bc9e-fe488f81f5e1","references":[{"source_name":"Crowdstrike Indrik November 2018","description":"Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"id":"S0575","name":"Conti","url":"https://attack.mitre.org/software/S0575","kind":"malware","description":"[Conti](https://attack.mitre.org/software/S0575) can enumerate remote open SMB network shares using <code>NetShareEnum()</code>.(Citation: CarbonBlack Conti July 2020)(Citation: CrowdStrike Wizard Spider October 2020)","relationship_id":"relationship--0852ea69-52d5-46d0-9847-3af87c8b15dc","references":[{"source_name":"CarbonBlack Conti July 2020","description":"Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"},{"source_name":"CrowdStrike Wizard Spider October 2020","description":"Podlosky, A., Hanel, A. et al. (2020, October 16). WIZARD SPIDER Update: Resilient, Reactive and Resolute. Retrieved June 15, 2021.","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) enumerates the directories of a network resource.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--d25f8661-bb36-479b-b5ca-ff21abc656b8","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0606","name":"Bad Rabbit","url":"https://attack.mitre.org/software/S0606","kind":"malware","description":"[Bad Rabbit](https://attack.mitre.org/software/S0606) enumerates open SMB shares on internal victim networks.(Citation: ESET Bad Rabbit)","relationship_id":"relationship--7431f8d2-32df-4b26-8b17-24f10f861fde","references":[{"source_name":"ESET Bad Rabbit","description":"M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021.","url":"https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/"}]},{"id":"S0611","name":"Clop","url":"https://attack.mitre.org/software/S0611","kind":"malware","description":"[Clop](https://attack.mitre.org/software/S0611) can enumerate network shares.(Citation: Mcafee Clop Aug 2019)","relationship_id":"relationship--b8e128df-429d-4a98-9b34-b179272a8344","references":[{"source_name":"Mcafee Clop Aug 2019","description":"Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"}]},{"id":"S0612","name":"WastedLocker","url":"https://attack.mitre.org/software/S0612","kind":"malware","description":"[WastedLocker](https://attack.mitre.org/software/S0612) can identify network adjacent and accessible drives.(Citation: Sentinel Labs WastedLocker July 2020)","relationship_id":"relationship--c6f2a62f-3aae-4245-8477-4d2ae96498d8","references":[{"source_name":"Sentinel Labs WastedLocker July 2020","description":"Walter, J.. (2020, July 23). WastedLocker Ransomware: Abusing ADS and NTFS File Attributes. Retrieved September 14, 2021.","url":"https://www.sentinelone.com/labs/wastedlocker-ransomware-abusing-ads-and-ntfs-file-attributes/"}]},{"id":"S0616","name":"DEATHRANSOM","url":"https://attack.mitre.org/software/S0616","kind":"malware","description":"[DEATHRANSOM](https://attack.mitre.org/software/S0616) has the ability to use loop operations to enumerate network resources.(Citation: FireEye FiveHands April 2021)","relationship_id":"relationship--f723b67d-5d1a-4bb2-8e0c-3d418bd93295","references":[{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}]},{"id":"S0617","name":"HELLOKITTY","url":"https://attack.mitre.org/software/S0617","kind":"malware","description":"[HELLOKITTY](https://attack.mitre.org/software/S0617) has the ability to enumerate network resources.(Citation: FireEye FiveHands April 2021)","relationship_id":"relationship--8debe90d-927a-4195-b796-793e9b1730ee","references":[{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}]},{"id":"S0618","name":"FIVEHANDS","url":"https://attack.mitre.org/software/S0618","kind":"malware","description":"[FIVEHANDS](https://attack.mitre.org/software/S0618) can enumerate network shares and mounted drives on a network.(Citation: NCC Group Fivehands June 2021)","relationship_id":"relationship--422b117a-9cb1-4d03-9b2d-000de5d8526e","references":[{"source_name":"NCC Group Fivehands June 2021","description":"Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.","url":"https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/"}]},{"id":"S0625","name":"Cuba","url":"https://attack.mitre.org/software/S0625","kind":"malware","description":"[Cuba](https://attack.mitre.org/software/S0625) can discover shared resources using the <code>NetShareEnum</code> API call.(Citation: McAfee Cuba April 2021) ","relationship_id":"relationship--268e786f-a23c-4bf3-a331-e2b9163b2974","references":[{"source_name":"McAfee Cuba April 2021","description":"Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}]},{"id":"S0638","name":"Babuk","url":"https://attack.mitre.org/software/S0638","kind":"malware","description":"[Babuk](https://attack.mitre.org/software/S0638) has the ability to enumerate network shares.(Citation: Sogeti CERT ESEC Babuk March 2021)","relationship_id":"relationship--bba92907-b2fd-4f62-b356-63fab9d714dd","references":[{"source_name":"Sogeti CERT ESEC Babuk March 2021","description":"Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"}]},{"id":"S0640","name":"Avaddon","url":"https://attack.mitre.org/software/S0640","kind":"malware","description":"[Avaddon](https://attack.mitre.org/software/S0640) has enumerated shared folders and mapped volumes.(Citation: Arxiv Avaddon Feb 2021)","relationship_id":"relationship--a7be99ec-2a20-406a-b552-7c32760bb52c","references":[{"source_name":"Arxiv Avaddon Feb 2021","description":"Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.","url":"https://arxiv.org/pdf/2102.04796.pdf"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can use <code>net share</code> to identify network shares for use in lateral movement.(Citation: Trend Micro Qakbot May 2020)(Citation: Kaspersky QakBot September 2021)","relationship_id":"relationship--2f6ae8d7-29ee-4af6-9284-f698393ee1b7","references":[{"source_name":"Trend Micro Qakbot May 2020","description":"Mendoza, E. et al. (2020, May 25). Qakbot Resurges, Spreads through VBS Files. Retrieved September 27, 2021.","url":"https://www.trendmicro.com/vinfo/ph/security/news/cybercrime-and-digital-threats/qakbot-resurges-spreads-through-vbs-files"},{"source_name":"Kaspersky QakBot September 2021","description":"Kuzmenko, A. et al. (2021, September 2). QakBot technical analysis. Retrieved September 27, 2021.","url":"https://securelist.com/qakbot-technical-analysis/103931/"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) has a `ENMDSKS` command to enumerates available network shares.(Citation: Fortinet Diavol July 2021) ","relationship_id":"relationship--39aeaed2-f7ca-4fb6-8268-13e8e995461e","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) has the ability to enumerate network shares.(Citation: Trend Micro DRBControl February 2020)","relationship_id":"relationship--8e744873-e85e-4b7c-b36c-96448e600c43","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"id":"S0686","name":"QuietSieve","url":"https://attack.mitre.org/software/S0686","kind":"malware","description":"[QuietSieve](https://attack.mitre.org/software/S0686) can identify and search networked drives for specific file name extensions.(Citation: Microsoft Actinium February 2022)","relationship_id":"relationship--f728406e-2862-4eca-be0e-2835255a49cd","references":[{"source_name":"Microsoft Actinium February 2022","description":"Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"}]},{"id":"S0689","name":"WhisperGate","url":"https://attack.mitre.org/software/S0689","kind":"malware","description":"[WhisperGate](https://attack.mitre.org/software/S0689) can enumerate connected remote logical drives.(Citation: Cisco Ukraine Wipers January 2022)","relationship_id":"relationship--8c263b12-46f5-452c-908e-3bc80fba3bf5","references":[{"source_name":"Cisco Ukraine Wipers January 2022","description":"Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.","url":"https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can enumerate shares on a compromised host.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--348d10f4-8519-47a0-89d4-24119c18b638","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0696","name":"Flagpro","url":"https://attack.mitre.org/software/S0696","kind":"malware","description":"[Flagpro](https://attack.mitre.org/software/S0696) has been used to execute `net view` to discover mapped network shares.(Citation: NTT Security Flagpro new December 2021)","relationship_id":"relationship--a9df6783-2c1d-417b-8cee-d9738416a183","references":[{"source_name":"NTT Security Flagpro new December 2021","description":"Hada, H. (2021, December 28).  Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}]},{"id":"S1053","name":"AvosLocker","url":"https://attack.mitre.org/software/S1053","kind":"malware","description":"[AvosLocker](https://attack.mitre.org/software/S1053) has enumerated shared drives on a compromised network.(Citation: Malwarebytes AvosLocker Jul 2021)(Citation: Joint CSA AvosLocker Mar 2022)","relationship_id":"relationship--d421d0ce-6821-4d06-9249-214daacac1b0","references":[{"source_name":"Joint CSA AvosLocker Mar 2022","description":"FBI, FinCEN, Treasury. (2022, March 17). Indicators of Compromise Associated with AvosLocker Ransomware. Retrieved January 11, 2023.","url":"https://www.ic3.gov/Media/News/2022/220318.pdf"},{"source_name":"Malwarebytes AvosLocker Jul 2021","description":"Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"}]},{"id":"S1068","name":"BlackCat","url":"https://attack.mitre.org/software/S1068","kind":"malware","description":"[BlackCat](https://attack.mitre.org/software/S1068) has the ability to discover network shares on compromised networks.(Citation: Microsoft BlackCat Jun 2022)(Citation: Sophos BlackCat Jul 2022)","relationship_id":"relationship--9cd85648-3618-4817-a178-d36d7c40631c","references":[{"source_name":"Sophos BlackCat Jul 2022","description":"Brandt, Andrew. (2022, July 14). BlackCat ransomware attacks not merely a byproduct of bad luck. Retrieved December 20, 2022.","url":"https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/"},{"source_name":"Microsoft BlackCat Jun 2022","description":"Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}]},{"id":"S1073","name":"Royal","url":"https://attack.mitre.org/software/S1073","kind":"malware","description":"[Royal](https://attack.mitre.org/software/S1073) can enumerate the shared resources of a given IP addresses using the API call `NetShareEnum`.(Citation: Cybereason Royal December 2022)","relationship_id":"relationship--855347b7-4f23-4565-8738-f21a014c75cc","references":[{"source_name":"Cybereason Royal December 2022","description":"Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"}]},{"id":"S1075","name":"KOPILUWAK","url":"https://attack.mitre.org/software/S1075","kind":"malware","description":"[KOPILUWAK](https://attack.mitre.org/software/S1075) can use [netstat](https://attack.mitre.org/software/S0104) and [Net](https://attack.mitre.org/software/S0039) to discover network shares.(Citation: Mandiant Suspected Turla Campaign February 2023)","relationship_id":"relationship--7e7479b9-57c6-4c40-898b-3c590e93d6f1","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","description":"Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can check a user's access to the C$ share on a compromised machine.(Citation: BitDefender BADHATCH Mar 2021) ","relationship_id":"relationship--003eed51-a560-44f1-9149-5a11bdaebe6f","references":[{"source_name":"BitDefender BADHATCH Mar 2021","description":"Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}]},{"id":"S1085","name":"Sardonic","url":"https://attack.mitre.org/software/S1085","kind":"malware","description":"[Sardonic](https://attack.mitre.org/software/S1085) has the ability to execute the `net view` command.(Citation: Bitdefender Sardonic Aug 2021)","relationship_id":"relationship--55ec954d-e553-4055-bc56-56b9dd0c433f","references":[{"source_name":"Bitdefender Sardonic Aug 2021","description":"Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}]},{"id":"S1129","name":"Akira","url":"https://attack.mitre.org/software/S1129","kind":"malware","description":"[Akira](https://attack.mitre.org/software/S1129) can identify remote file shares for encryption.(Citation: Kersten Akira 2023)","relationship_id":"relationship--7ef41aaa-7625-4168-b040-92972454b8fb","references":[{"source_name":"Kersten Akira 2023","description":"Max Kersten & Alexandre Mundo. (2023, November 29). Akira Ransomware. Retrieved April 4, 2024.","url":"https://www.trellix.com/blogs/research/akira-ransomware/"}]},{"id":"S1139","name":"INC Ransomware","url":"https://attack.mitre.org/software/S1139","kind":"malware","description":"[INC Ransomware](https://attack.mitre.org/software/S1139) has the ability to check for shared network drives to encrypt.(Citation: Cybereason INC Ransomware November 2023)","relationship_id":"relationship--6c62f14a-0c1a-4dea-82eb-8c352d0c5f70","references":[{"source_name":"Cybereason INC Ransomware November 2023","description":"Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"}]},{"id":"S1141","name":"LunarWeb","url":"https://attack.mitre.org/software/S1141","kind":"malware","description":"[LunarWeb](https://attack.mitre.org/software/S1141) can identify shared resources in compromised environments.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--3bb1eae7-1653-4a38-9b4b-6bd93503f6ca","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) can identify and enumerate victim system network shares.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--ff27aa33-f4da-424e-be51-ade535b359b3","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1160","name":"Latrodectus","url":"https://attack.mitre.org/software/S1160","kind":"malware","description":"\n[Latrodectus](https://attack.mitre.org/software/S1160) can run `C:\\Windows\\System32\\cmd.exe /c net view /all` to discover network shares.(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)","relationship_id":"relationship--20d2449b-aa52-40bc-8a7a-5c6f72eb3ce0","references":[{"source_name":"Bitsight Latrodectus June 2024","description":"Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Elastic Latrodectus May 2024","description":"Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024.","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}]},{"id":"S1180","name":"BlackByte Ransomware","url":"https://attack.mitre.org/software/S1180","kind":"malware","description":"[BlackByte Ransomware](https://attack.mitre.org/software/S1180) can identify network shares connected to the victim machine.(Citation: Trustwave BlackByte 2021)","relationship_id":"relationship--037f8492-bbc1-481e-bbbe-d23f2f7d2870","references":[{"source_name":"Trustwave BlackByte 2021","description":"Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}]},{"id":"S1181","name":"BlackByte 2.0 Ransomware","url":"https://attack.mitre.org/software/S1181","kind":"malware","description":"[BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) can identify network shares connected to the victim machine.(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--7b2c432a-d474-4172-ad7b-06b84dc813ae","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) can discover remote shares.(Citation: FBI Lockbit 2.0 FEB 2022)","relationship_id":"relationship--8129042e-5e4b-412b-bbb7-a127312abf25","references":[{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can identify network shares on compromised systems.(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)","relationship_id":"relationship--98b296c0-467b-4029-a813-0cd94c0a9520","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"}]},{"id":"S1212","name":"RansomHub","url":"https://attack.mitre.org/software/S1212","kind":"malware","description":"[RansomHub](https://attack.mitre.org/software/S1212) has the ability to target specific network shares for encryption.(Citation: Group-IB RansomHub FEB 2025)","relationship_id":"relationship--c5645eeb-3d3d-4ac8-b9c1-2948ec35d425","references":[{"source_name":"Group-IB RansomHub FEB 2025","description":"Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) has the ability to list network drives.(Citation: Trend Micro Agenda Ransomware AUG 2022)(Citation: Halcyon Qilin.B OCT 2024)","relationship_id":"relationship--6e1fe223-d295-4784-b64a-2e2b6586b782","references":[{"source_name":"Halcyon Qilin.B OCT 2024","description":"Halcyon RISE Team. (2024, October 24). New Qilin.B Ransomware Variant Boasts Enhanced Encryption and Defense Evasion. Retrieved September 26, 2025.","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"},{"source_name":"Trend Micro Agenda Ransomware AUG 2022","description":"Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has identified networked drives.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--160fe071-f28f-47c3-a87c-e7cfc9e72f31","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S1247","name":"Embargo","url":"https://attack.mitre.org/software/S1247","kind":"malware","description":"[Embargo](https://attack.mitre.org/software/S1247) has searched for folders, subfolders and other networked or mounted drives for follow-on encryption actions.(Citation: Cyble Embargo Ransomware May 2024)","relationship_id":"relationship--7ed71499-07cb-4cea-9a7e-5822a69b28e3","references":[{"source_name":"Cyble Embargo Ransomware May 2024","description":"Cyble. (2024, May 24). The Rust Revolution: New Embargo Ransomware Steps In. Retrieved October 19, 2025.","url":"https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/"}]},{"id":"S9045","name":"BACKUPOSINT v9.0 APEX PREDATOR","url":"https://attack.mitre.org/software/S9045","kind":"malware","description":"[BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) has the ability to identify NFS and SMB shares within the victim environment.(Citation: AI-Mexico-Govt-Compromise) ","relationship_id":"relationship--af151fa2-39c4-4f60-a66c-8e67982e83b6","references":[{"source_name":"AI-Mexico-Govt-Compromise","description":"Jay Deen. (2026, May). AI-Assisted Compromise of Mexican Water Utility with OT Implications. Retrieved September 2, 2026.","url":"https://5943619.hs-sites.com/hubfs/116-Whitepapers/dragos-2026-ai-mexico-water-attack-intel-brief.pdf"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has discovered and enumerated network shares using `net use` with corresponding sequential drive letters from A through Z.(Citation: MSTI_GentelmenRansomware_May2026) [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has also enumerated network shares using Windows APIs to include `WnetOpenEnumW`, `WNetEnumResourceW`, and `WNetCloseEnum`.(Citation: CheckPointResearch_TheGentlemen_April2026) ","relationship_id":"relationship--f3f8ff44-e693-4ba6-8ac8-3aa9d2d38969","references":[{"source_name":"CheckPointResearch_TheGentlemen_April2026","description":"Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"},{"source_name":"MSTI_GentelmenRansomware_May2026","description":"Microsoft Threat Intelligence. (2026, May 28). The Gentlemen ransomware: Dissecting a self-propagating Go encryptor . Retrieved September 18, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"}]}],"actors":[{"id":"G0006","name":"APT1","url":"https://attack.mitre.org/groups/G0006","kind":"intrusion-set","description":"[APT1](https://attack.mitre.org/groups/G0006) listed connected network shares.(Citation: Mandiant APT1)","relationship_id":"relationship--e07b76a4-98d7-4adc-b90e-a1f7f2266867","references":[{"source_name":"Mandiant APT1","description":"Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.(Citation: US-CERT TA18-074A)","relationship_id":"relationship--d2f19ee3-8e1c-46e4-b803-e8b3fa36f62e","references":[{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050) used the <code>net view</code> command to show all shares available, including the administrative shares such as <code>C$</code> and <code>ADMIN$</code>.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--3c3f5cdb-f2cd-4bab-8196-26f160b38a5e","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"G0054","name":"Sowbug","url":"https://attack.mitre.org/groups/G0054","kind":"intrusion-set","description":"[Sowbug](https://attack.mitre.org/groups/G0054) listed remote shared drives that were accessible from a victim.(Citation: Symantec Sowbug Nov 2017)","relationship_id":"relationship--cc495391-9abd-4df1-8ad7-ec8d84feaeb9","references":[{"source_name":"Symantec Sowbug Nov 2017","description":"Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) used <code>netview</code> to scan target systems for shared resources.(Citation: TrendMicro TropicTrooper 2015)","relationship_id":"relationship--c4f4fe39-af57-47d3-8428-fe5bce63bdbb","references":[{"source_name":"TrendMicro TropicTrooper 2015","description":"Alintanahin, K. (2015). Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers. Retrieved June 14, 2019.","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has enumerated network shares on a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: Microsoft Sapphire Sleet APR 2026)","relationship_id":"relationship--82660969-2c24-46a6-a451-1b41240b9ed7","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","description":"DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source_name":"Microsoft Sapphire Sleet APR 2026","description":"Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used the post exploitation tool [CrackMapExec](https://attack.mitre.org/software/S0488) to enumerate network shares.(Citation: BitDefender Chafer May 2020)","relationship_id":"relationship--307e732c-c407-4466-951b-38062bb5e32b","references":[{"source_name":"BitDefender Chafer May 2020","description":"Rusu, B. (2020, May 21). Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia. Retrieved May 22, 2020.","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":" [APT41](https://attack.mitre.org/groups/G0096) used the <code>net share</code> command as part of network reconnaissance.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)","relationship_id":"relationship--4f6e677d-427b-4342-b35c-57f4f3ad4ff8","references":[{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source_name":"Group IB APT 41 June 2021","description":"Rostovcev, N. (2021, June 10). Big airline heist APT41 likely behind a third-party attack on Air India. Retrieved August 26, 2021.","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"id":"G0102","name":"Wizard Spider","url":"https://attack.mitre.org/groups/G0102","kind":"intrusion-set","description":"[Wizard Spider](https://attack.mitre.org/groups/G0102) has used the “net view” command to locate mapped network shares.(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)","relationship_id":"relationship--eaebb080-e57e-4c06-84df-376cc8bff09e","references":[{"source_name":"DHS/CISA Ransomware Targeting Healthcare October 2020","description":"DHS/CISA. (2020, October 28). Ransomware Activity Targeting the Healthcare and Public Health Sector. Retrieved October 28, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"}]},{"id":"G0105","name":"DarkVishnya","url":"https://attack.mitre.org/groups/G0105","kind":"intrusion-set","description":"[DarkVishnya](https://attack.mitre.org/groups/G0105) scanned the network for public shared folders.(Citation: Securelist DarkVishnya Dec 2018)","relationship_id":"relationship--3a31f8c0-36bf-40b5-90d2-d03c72b2c8d8","references":[{"source_name":"Securelist DarkVishnya Dec 2018","description":"Golovanov, S. (2018, December 6). DarkVishnya: Banks attacked through direct connection to local network. Retrieved May 15, 2020.","url":"https://securelist.com/darkvishnya/89169/"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has used <code>net share</code> and <code>net view</code> to identify network shares of interest.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--71cac5bb-2d68-44b8-ae8a-4d159c06ec61","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0131","name":"Tonto Team","url":"https://attack.mitre.org/groups/G0131","kind":"intrusion-set","description":"[Tonto Team](https://attack.mitre.org/groups/G0131) has used tools such as [NBTscan](https://attack.mitre.org/software/S0590) to enumerate network shares.(Citation: TrendMicro Tonto Team October 2020)","relationship_id":"relationship--09673a33-d15e-460a-8980-55c67ee2bb19","references":[{"source_name":"TrendMicro Tonto Team October 2020","description":"Daniel Lughi, Jaromir Horejsi. (2020, October 2). Tonto Team - Exploring the TTPs of an advanced threat actor operating a large infrastructure. Retrieved October 17, 2021.","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"id":"G1016","name":"FIN13","url":"https://attack.mitre.org/groups/G1016","kind":"intrusion-set","description":"[FIN13](https://attack.mitre.org/groups/G1016) has executed net view commands for enumeration of open shares on compromised machines.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)","relationship_id":"relationship--c31ccdbd-e501-41cb-98d9-46cdff9be1c0","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","description":"Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source_name":"Mandiant FIN13 Aug 2022","description":"Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"id":"G1032","name":"INC Ransom","url":"https://attack.mitre.org/groups/G1032","kind":"intrusion-set","description":"[INC Ransom](https://attack.mitre.org/groups/G1032) has used Internet Explorer to view folders on other systems.(Citation: Huntress INC Ransom Group August 2023)","relationship_id":"relationship--c7ed191d-dbff-48c9-8a6b-baf056156baf","references":[{"source_name":"Huntress INC Ransom Group August 2023","description":"Team Huntress. (2023, August 11). Investigating New INC Ransom Group Activity. Retrieved June 5, 2024.","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) enumerated network shares on victim devices.(Citation: Cisco BlackByte 2024)","relationship_id":"relationship--a9d3ddcc-36fa-44d8-9a0a-07688467a137","references":[{"source_name":"Cisco BlackByte 2024","description":"James Nutland, Craig Jackson, Terryn Valikodath, & Brennan Evans. (2024, August 28). BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks. Retrieved December 16, 2024.","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has identified network shares using `cmd.exe /c net share`.(Citation: CISA Medusa Group Medusa Ransomware March 2025)","relationship_id":"relationship--5bc76bbe-dd5b-4787-ba2d-67ff5d76fbe9","references":[{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]}],"mitigations":[{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"Enable Windows Group Policy “Do Not Allow Anonymous Enumeration of SAM Accounts and Shares” security setting to limit users who can enumerate network shares.(Citation: Windows Anonymous Enumeration of SAM Accounts)","relationship_id":"relationship--af69bb4e-4cdb-4a9d-afff-5508c99c1276","references":[{"source_name":"Windows Anonymous Enumeration of SAM Accounts","description":"Microsoft. (2017, April 19). Network access: Do not allow anonymous enumeration of SAM accounts and shares. Retrieved May 20, 2020.","url":"https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares"}]}],"candidates":[{"id":"13daa2cf-195a-43df-a8bd-7dd5ffb607b5","name":"Network Share Discovery via dir command","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"Network Share Discovery utilizing the dir command prompt. The computer ip variable may need to be modified to point to a different host ip\nUpon execution available network shares will be displayed in the commandline session\n","inputs":{"computer_ip":{"description":"Computer IP to find a mount on.","type":"string","default":"127.0.0.1"}},"dependencies":[],"source_definition_sha256":"577b344ef9fbac5eacf2f7efcf2219f432fc5a3fd91f9b171298ef87b06b5fd1"},{"id":"1b0814d1-bb24-402d-9615-1b20c50733fb","name":"Network Share Discovery PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"Network Share Discovery utilizing PowerShell. The computer name variable may need to be modified to point to a different host\nUpon execution, available network shares will be displayed in the powershell session\n","inputs":{},"dependencies":[],"source_definition_sha256":"c610ce4c9155385bc895013744e7f7ce194e6c2356dab264cf8dcdf43c36daff"},{"id":"20f1097d-81c1-405c-8380-32174d493bbb","name":"Network Share Discovery command prompt","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"Network Share Discovery utilizing the command prompt. The computer name variable may need to be modified to point to a different host\nUpon execution available network shares will be displayed in the powershell session\n","inputs":{"computer_name":{"description":"Computer name to find a mount on.","type":"string","default":"localhost"}},"dependencies":[],"source_definition_sha256":"b4cb9388a05d876e69f77c04701a2009d8fa302f4f7bbb24af867f69698ae337"},{"id":"77e468a6-3e5c-45a1-9948-c4b5603747cb","name":"Network Share Discovery - FreeBSD","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"Network Share Discovery using smbstatus\n","inputs":{"package_checker":{"description":"Package checking command. pkg info -x samba","type":"string","default":"(pkg info -x samba &>/dev/null)"},"package_installer":{"description":"Package installer command. pkg install -y samba413","type":"string","default":"(which pkg && pkg install -y samba413)"}},"dependencies":[{"description":"Package with smbstatus (samba) must exist on device\n"}],"source_definition_sha256":"631051806c0b6ae31f51309544b364adfac3aa174f3099dcc709057fdbaaeb3e"},{"id":"875805bc-9e86-4e87-be86-3a5527315cae","name":"Network Share Discovery - linux","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"Network Share Discovery using smbstatus\n","inputs":{"package_checker":{"description":"Package checking command. Debian - dpkg -s samba","type":"string","default":"(rpm -q samba &>/dev/null) || (dpkg -s samba | grep -q installed)"},"package_installer":{"description":"Package installer command. Debian - apt install samba","type":"string","default":"(which yum && yum -y install epel-release samba)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y samba)"}},"dependencies":[{"description":"Package with smbstatus (samba) must exist on device\n"}],"source_definition_sha256":"ccb10b534a2c92b6f634cb0c0e40ed1a0a61887a0bc97325a5ce040be7e2a5fd"},{"id":"987901d1-5b87-4558-a6d9-cffcabc638b8","name":"WinPwn - shareenumeration","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"Network share enumeration using the shareenumeration function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"9d4d60485054257aa698b79acdd767277e74245ef235e7eb0be2c842972fbdaf"},{"id":"ab39a04f-0c93-4540-9ff2-83f862c385ae","name":"View available share drives","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"View information about all of the resources that are shared on the local computer Upon execution, available share drives will be displayed in the powershell session","inputs":{},"dependencies":[],"source_definition_sha256":"31bd0da37ee760dd7044e95756fc928a7e5bd892fbce8bc1ba6d23e016c38252"},{"id":"b1636f0a-ba82-435c-b699-0d78794d8bfd","name":"Share Discovery with PowerView","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"Enumerate Domain Shares the current user has access. Upon execution, progress info about each share being scanned will be displayed.\n","inputs":{},"dependencies":[{"description":"Endpoint must be joined to domain\n"}],"source_definition_sha256":"e9e8677f51b916930ae8b7ec115f9bca513fad9d02e43868ef8c4e6b48d66a6d"},{"id":"b19d74b7-5e72-450a-8499-82e49e379d1a","name":"Enumerate All Network Shares with Snaffler","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"Snaffler is an open-source tool that has been used by various threat groups, including Scattered Spider/Muddled Libra, to enumerate accessible shares and credential-containing files within a domain. \n[Reference](https://unit42.paloaltonetworks.com/muddled-libra/)\n","inputs":{"output_path":{"description":"File to output enumeration results to","type":"String","default":"$env:temp\\T1135SnafflerOutput.txt"},"snaffler_path":{"description":"Path to the Snaffler executable","type":"String","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\Snaffler.exe"}},"dependencies":[{"description":"The Snaffler executable must exist on disk"}],"source_definition_sha256":"5d83d4616cedb2d6c3228fafab536c6517007a148108a61df00110e03e421c0f"},{"id":"d07e4cc1-98ae-447e-9d31-36cb430d28c4","name":"PowerView ShareFinder","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"PowerView is a PowerShell tool to gain network situational awareness on Windows domains. ShareFinder finds (non-standard) shares on machines in the domain.","inputs":{"parameters":{"description":"ShareFinder parameter","type":"string","default":"-CheckShareAccess"}},"dependencies":[{"description":"Invoke-ShareFinder module must exist in %TEMP% directory"}],"source_definition_sha256":"ef84be2a2db0a38ffb7b1d55a51aa734ecce0004743586aaad26b28de9a0cc25"},{"id":"d1fa2a69-b0a2-4e8a-9112-529b00c19a41","name":"Enumerate All Network Shares with SharpShares","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"SharpShares is a command line tool that can be integrated with Cobalt Strike's execute-assembly module, allowing for the enumeration of network shares. \nThis technique has been utilized by various ransomware groups, including BianLian.\n[Reference](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a)\n","inputs":{"output_path":{"description":"File to output enumeration results to","type":"String","default":"$env:temp\\T1135SharpSharesOutput.txt"},"sharp_path":{"description":"Path to the SharpShares executable","type":"String","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\SharpShares.exe"}},"dependencies":[{"description":"The SharpShares executable must exist on disk"}],"source_definition_sha256":"3dfb6f4f3e608364f2ebd9ead5298f3c160017c4b7f02cce9f2b013edbb836d8"},{"id":"f94b5ad9-911c-4eff-9718-fd21899db4f7","name":"Network Share Discovery","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1135/T1135.yaml","description":"Network Share Discovery\n","inputs":{"computer_name":{"description":"Computer name to find a mount on.","type":"string","default":"computer1"}},"dependencies":[],"source_definition_sha256":"19123ad28f7610b7e6d9d6797bd0ae34057a7bf24bddccfa12aef5e4734ecb3c"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1135":"/ttp-simulation/techniques/enterprise/T1135/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1135","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0048","collector":"illustrative-lab-collector","observation":{"pipe_name":"\\\\.\\pipe\\lab-demo","action":"connect","process_id":4200}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}