T1135 Network Share Discovery — Attack Simulation

DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.

Providers and collection configuration

• PowerShell Script Block Logging: Script content via event 4104 when configured; channel depends on PowerShell edition.
• Sysmon process events: Interpreter launch and parent context, not full script content.
• Linux Audit: execve-family execution context; shell built-ins need additional instrumentation.

• Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.
• Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.
• On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records.

Required normalized fields: interpreter, command_line, actor_uid, session_id.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0064",
  "collector": "illustrative-lab-collector",
  "observation": {
    "interpreter": "/bin/sh",
    "command_line": "printf LAB_TELEMETRY_CHECK",
    "actor_uid": 1000,
    "session_id": "lab-session-1"
  }
}

Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.

DC0048 collection page — Collect Sysmon PipeEvent 17–18 with pipe name and owning/connecting process; pipe contents require other instrumentation.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence.

Required normalized fields: pipe_name, action, process_id.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0048",
  "collector": "illustrative-lab-collector",
  "observation": {
    "pipe_name": "\\\\.\\pipe\\lab-demo",
    "action": "connect",
    "process_id": 4200
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0082",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "initiated": true
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0078 collection page — Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
• AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: source_ip, destination_ip, destination_port, protocol, bytes_sent, bytes_received.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0078",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source_ip": "192.0.2.10",
    "destination_ip": "198.51.100.20",
    "destination_port": 443,
    "protocol": "tcp",
    "bytes_sent": 128,
    "bytes_received": 512
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

DC0021 collection page — Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.

Providers and collection configuration

• Application audit logs: First-party service events and request/result fields; schema is application-specific.
• OpenTelemetry-compatible log pipelines: Transport and normalization of emitted records; do not create missing audit instrumentation.

• Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
• Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
• Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.

Required normalized fields: process_id, api, path, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0021",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "api": "CreateFileW",
    "path": "C:\\Lab\\demo.txt",
    "result": "success"
  }
}

Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

MITRE detection strategy

4 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell — test; product: windows; category: process_creation.
• HackTool - SharpView Execution — test; category: process_creation; product: windows.
• PUA - Advanced IP Scanner Execution — test; category: process_creation; product: windows.
• PUA - Advanced Port Scanner Execution — test; category: process_creation; product: windows.

• S0013 PlugX — malware.

  PlugX has a module to enumerate network shares.[Eset PlugX Korplug Mustang Panda March 2022][CIRCL PlugX March 2013]

  Exact relationship: relationship--5e7460f8-9ea9-4aa4-b06e-15861b02d70e
• S0039 Net — tool.

  The <code>net view \\remotesystem</code> and <code>net share</code> commands in Net can be used to find shared drives and directories on remote and local systems respectively.[Savill 1999]

  Exact relationship: relationship--3b5d1788-c59b-4e84-97b0-b109df608619
• S0154 Cobalt Strike — malware.

  Cobalt Strike can query shared drives on the local system.[Cobalt Strike TTPs Dec 2017]

  Exact relationship: relationship--a106b02a-0a6a-493f-911c-a00576013004
• S0165 OSInfo — malware.

  OSInfo discovers shares on the network[Symantec Buckeye]

  Exact relationship: relationship--d07f2da6-6497-414f-96c1-9dd60155b169
• S0192 Pupy — tool.

  Pupy can list local and remote shared drives and folders over SMB.[GitHub Pupy]

  Exact relationship: relationship--1ba0b437-e809-479c-a254-172e706c3615
• S0233 MURKYTOP — malware.

  MURKYTOP has the capability to retrieve information about shares on remote hosts.[FireEye Periscope March 2018]

  Exact relationship: relationship--cffbdd23-bf18-4bb9-bd50-dc74b69784e2
• S0236 Kwampirs — malware.

  Kwampirs collects a list of network shares with the command <code>net share</code>.[Symantec Orangeworm April 2018]

  Exact relationship: relationship--2beb9f29-a94b-469a-870e-2e2072bf941c
• S0250 Koadic — tool.

  Koadic can scan local network for open SMB.[Github Koadic]

  Exact relationship: relationship--f25505f6-dbd0-4d7b-8e8c-b3885f206cbf
• S0251 Zebrocy — malware.

  Zebrocy identifies network drives when they are added to victim systems.[Securelist Sofacy Feb 2018]

  Exact relationship: relationship--e27ebd5b-4ed3-4c04-96e3-026bd127ed64
• S0260 InvisiMole — malware.

  InvisiMole can gather network share information.[ESET InvisiMole June 2018]

  Exact relationship: relationship--e1d0ec8e-0970-4737-9605-1cf8a3ba1371
• S0266 TrickBot — malware.

  TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.[ESET Trickbot Oct 2020][Bitdefender Trickbot March 2020]

  Exact relationship: relationship--7cbc6309-f5fb-41e5-901b-67f02f29a834
• S0363 Empire — tool.

  Empire can find shared drives on the local system.[Github PowerShell Empire]

  Exact relationship: relationship--6fa815b2-23dc-455f-b358-dacb4e30a073
• S0365 Olympic Destroyer — malware.

  Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.[Talos Olympic Destroyer 2018]

  Exact relationship: relationship--c72b2674-e757-4290-9275-cc08a12713be
• S0367 Emotet — malware.

  Emotet has enumerated non-hidden network shares using `WNetEnumResourceW`. [Binary Defense Emotes Wi-Fi Spreader]

  Exact relationship: relationship--491dc622-fa43-4015-b24a-8ec8d8f5a376
• S0444 ShimRat — malware.

  ShimRat can enumerate connected drives for infected host machines.[FOX-IT May 2016 Mofang]

  Exact relationship: relationship--d2ef2109-c65f-452b-bb5b-dd06d1b16602
• S0458 Ramsay — malware.

  Ramsay can scan for network drives which may contain documents for collection.[Eset Ramsay May 2020][Antiy CERT Ramsay April 2020]

  Exact relationship: relationship--0428220b-eb98-45c3-a637-7da54b4496b4
• S0483 IcedID — malware.

  IcedID has used the `net view /all` command to show available shares.[DFIR_Quantum_Ransomware]

  Exact relationship: relationship--ba575869-1ac0-4681-aee2-37ecd3e6fed5
• S0488 CrackMapExec — tool.

  CrackMapExec can enumerate the shared folders and associated permissions for a targeted network.[CME Github September 2018]

  Exact relationship: relationship--61d859c1-c6f4-4f5f-bc5f-032481dddbe4
• S0534 Bazar — malware.

  Bazar can enumerate shared drives on the domain.[NCC Group Team9 June 2020]

  Exact relationship: relationship--203108df-424d-4dfe-ac45-3cbd84c71615
• S0570 BitPaymer — malware.

  BitPaymer can search for network shares on the domain or workgroup using <code>net view <host></code>.[Crowdstrike Indrik November 2018]

  Exact relationship: relationship--6743c3f6-7f4f-40b3-bc9e-fe488f81f5e1
• S0575 Conti — malware.

  Conti can enumerate remote open SMB network shares using <code>NetShareEnum()</code>.[CarbonBlack Conti July 2020][CrowdStrike Wizard Spider October 2020]

  Exact relationship: relationship--0852ea69-52d5-46d0-9847-3af87c8b15dc
• S0603 Stuxnet — malware.

  Stuxnet enumerates the directories of a network resource.[Nicolas Falliere, Liam O Murchu, Eric Chien February 2011]

  Exact relationship: relationship--d25f8661-bb36-479b-b5ca-ff21abc656b8
• S0606 Bad Rabbit — malware.

  Bad Rabbit enumerates open SMB shares on internal victim networks.[ESET Bad Rabbit]

  Exact relationship: relationship--7431f8d2-32df-4b26-8b17-24f10f861fde
• S0611 Clop — malware.

  Clop can enumerate network shares.[Mcafee Clop Aug 2019]

  Exact relationship: relationship--b8e128df-429d-4a98-9b34-b179272a8344
• S0612 WastedLocker — malware.

  WastedLocker can identify network adjacent and accessible drives.[Sentinel Labs WastedLocker July 2020]

  Exact relationship: relationship--c6f2a62f-3aae-4245-8477-4d2ae96498d8
• S0616 DEATHRANSOM — malware.

  DEATHRANSOM has the ability to use loop operations to enumerate network resources.[FireEye FiveHands April 2021]

  Exact relationship: relationship--f723b67d-5d1a-4bb2-8e0c-3d418bd93295
• S0617 HELLOKITTY — malware.

  HELLOKITTY has the ability to enumerate network resources.[FireEye FiveHands April 2021]

  Exact relationship: relationship--8debe90d-927a-4195-b796-793e9b1730ee
• S0618 FIVEHANDS — malware.

  FIVEHANDS can enumerate network shares and mounted drives on a network.[NCC Group Fivehands June 2021]

  Exact relationship: relationship--422b117a-9cb1-4d03-9b2d-000de5d8526e
• S0625 Cuba — malware.

  Cuba can discover shared resources using the <code>NetShareEnum</code> API call.[McAfee Cuba April 2021]

  Exact relationship: relationship--268e786f-a23c-4bf3-a331-e2b9163b2974
• S0638 Babuk — malware.

  Babuk has the ability to enumerate network shares.[Sogeti CERT ESEC Babuk March 2021]

  Exact relationship: relationship--bba92907-b2fd-4f62-b356-63fab9d714dd
• S0640 Avaddon — malware.

  Avaddon has enumerated shared folders and mapped volumes.[Arxiv Avaddon Feb 2021]

  Exact relationship: relationship--a7be99ec-2a20-406a-b552-7c32760bb52c
• S0650 QakBot — malware.

  QakBot can use <code>net share</code> to identify network shares for use in lateral movement.[Trend Micro Qakbot May 2020][Kaspersky QakBot September 2021]

  Exact relationship: relationship--2f6ae8d7-29ee-4af6-9284-f698393ee1b7
• S0659 Diavol — malware.

  Diavol has a `ENMDSKS` command to enumerates available network shares.[Fortinet Diavol July 2021]

  Exact relationship: relationship--39aeaed2-f7ca-4fb6-8268-13e8e995461e
• S0660 Clambling — malware.

  Clambling has the ability to enumerate network shares.[Trend Micro DRBControl February 2020]

  Exact relationship: relationship--8e744873-e85e-4b7c-b36c-96448e600c43
• S0686 QuietSieve — malware.

  QuietSieve can identify and search networked drives for specific file name extensions.[Microsoft Actinium February 2022]

  Exact relationship: relationship--f728406e-2862-4eca-be0e-2835255a49cd
• S0689 WhisperGate — malware.

  WhisperGate can enumerate connected remote logical drives.[Cisco Ukraine Wipers January 2022]

  Exact relationship: relationship--8c263b12-46f5-452c-908e-3bc80fba3bf5
• S0692 SILENTTRINITY — tool.

  SILENTTRINITY can enumerate shares on a compromised host.[GitHub SILENTTRINITY Modules July 2019]

  Exact relationship: relationship--348d10f4-8519-47a0-89d4-24119c18b638
• S0696 Flagpro — malware.

  Flagpro has been used to execute `net view` to discover mapped network shares.[NTT Security Flagpro new December 2021]

  Exact relationship: relationship--a9df6783-2c1d-417b-8cee-d9738416a183
• S1053 AvosLocker — malware.

  AvosLocker has enumerated shared drives on a compromised network.[Malwarebytes AvosLocker Jul 2021][Joint CSA AvosLocker Mar 2022]

  Exact relationship: relationship--d421d0ce-6821-4d06-9249-214daacac1b0
• S1068 BlackCat — malware.

  BlackCat has the ability to discover network shares on compromised networks.[Microsoft BlackCat Jun 2022][Sophos BlackCat Jul 2022]

  Exact relationship: relationship--9cd85648-3618-4817-a178-d36d7c40631c
• S1073 Royal — malware.

  Royal can enumerate the shared resources of a given IP addresses using the API call `NetShareEnum`.[Cybereason Royal December 2022]

  Exact relationship: relationship--855347b7-4f23-4565-8738-f21a014c75cc
• S1075 KOPILUWAK — malware.

  KOPILUWAK can use netstat and Net to discover network shares.[Mandiant Suspected Turla Campaign February 2023]

  Exact relationship: relationship--7e7479b9-57c6-4c40-898b-3c590e93d6f1
• S1081 BADHATCH — malware.

  BADHATCH can check a user's access to the C$ share on a compromised machine.[BitDefender BADHATCH Mar 2021]

  Exact relationship: relationship--003eed51-a560-44f1-9149-5a11bdaebe6f
• S1085 Sardonic — malware.

  Sardonic has the ability to execute the `net view` command.[Bitdefender Sardonic Aug 2021]

  Exact relationship: relationship--55ec954d-e553-4055-bc56-56b9dd0c433f
• S1129 Akira — malware.

  Akira can identify remote file shares for encryption.[Kersten Akira 2023]

  Exact relationship: relationship--7ef41aaa-7625-4168-b040-92972454b8fb
• S1139 INC Ransomware — malware.

  INC Ransomware has the ability to check for shared network drives to encrypt.[Cybereason INC Ransomware November 2023]

  Exact relationship: relationship--6c62f14a-0c1a-4dea-82eb-8c352d0c5f70
• S1141 LunarWeb — malware.

  LunarWeb can identify shared resources in compromised environments.[ESET Turla Lunar toolset May 2024]

  Exact relationship: relationship--3bb1eae7-1653-4a38-9b4b-6bd93503f6ca
• S1159 DUSTTRAP — malware.

  DUSTTRAP can identify and enumerate victim system network shares.[Google Cloud APT41 2024]

  Exact relationship: relationship--ff27aa33-f4da-424e-be51-ade535b359b3
• S1160 Latrodectus — malware.

  Latrodectus can run `C:\Windows\System32\cmd.exe /c net view /all` to discover network shares.[Elastic Latrodectus May 2024][Bitsight Latrodectus June 2024]

  Exact relationship: relationship--20d2449b-aa52-40bc-8a7a-5c6f72eb3ce0
• S1180 BlackByte Ransomware — malware.

  BlackByte Ransomware can identify network shares connected to the victim machine.[Trustwave BlackByte 2021]

  Exact relationship: relationship--037f8492-bbc1-481e-bbbe-d23f2f7d2870
• S1181 BlackByte 2.0 Ransomware — malware.

  BlackByte 2.0 Ransomware can identify network shares connected to the victim machine.[Microsoft BlackByte 2023]

  Exact relationship: relationship--7b2c432a-d474-4172-ad7b-06b84dc813ae
• S1199 LockBit 2.0 — malware.

  LockBit 2.0 can discover remote shares.[FBI Lockbit 2.0 FEB 2022]

  Exact relationship: relationship--8129042e-5e4b-412b-bbb7-a127312abf25
• S1202 LockBit 3.0 — malware.

  LockBit 3.0 can identify network shares on compromised systems.[Joint Cybersecurity Advisory LockBit 3.0 MAR 2023]

  Exact relationship: relationship--98b296c0-467b-4029-a813-0cd94c0a9520
• S1212 RansomHub — malware.

  RansomHub has the ability to target specific network shares for encryption.[Group-IB RansomHub FEB 2025]

  Exact relationship: relationship--c5645eeb-3d3d-4ac8-b9c1-2948ec35d425
• S1242 Qilin — malware.

  Qilin has the ability to list network drives.[Trend Micro Agenda Ransomware AUG 2022][Halcyon Qilin.B OCT 2024]

  Exact relationship: relationship--6e1fe223-d295-4784-b64a-2e2b6586b782
• S1244 Medusa Ransomware — malware.

  Medusa Ransomware has identified networked drives.[Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024][Broadcom Medusa Ransomware Medusa Group March 2025][Security Scorecard Medusa Ransomware January 2024]

  Exact relationship: relationship--160fe071-f28f-47c3-a87c-e7cfc9e72f31
• S1247 Embargo — malware.

  Embargo has searched for folders, subfolders and other networked or mounted drives for follow-on encryption actions.[Cyble Embargo Ransomware May 2024]

  Exact relationship: relationship--7ed71499-07cb-4cea-9a7e-5822a69b28e3
• S9045 BACKUPOSINT v9.0 APEX PREDATOR — malware.

  BACKUPOSINT v9.0 APEX PREDATOR has the ability to identify NFS and SMB shares within the victim environment.[AI-Mexico-Govt-Compromise]

  Exact relationship: relationship--af151fa2-39c4-4f60-a66c-8e67982e83b6
• S9051 The Gentlemen Ransomware — malware.

  The Gentlemen Ransomware has discovered and enumerated network shares using `net use` with corresponding sequential drive letters from A through Z.[MSTI_GentelmenRansomware_May2026] The Gentlemen Ransomware has also enumerated network shares using Windows APIs to include `WnetOpenEnumW`, `WNetEnumResourceW`, and `WNetCloseEnum`.[CheckPointResearch_TheGentlemen_April2026]

  Exact relationship: relationship--f3f8ff44-e693-4ba6-8ac8-3aa9d2d38969

Network Share Discovery utilizing the dir command prompt. The computer ip variable may need to be modified to point to a different host ip
Upon execution available network shares will be displayed in the commandline session

Pinned Atomic procedure · 13daa2cf-195a-43df-a8bd-7dd5ffb607b5 · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• computer_ip: Computer IP to find a mount on. (type string; source default 127.0.0.1)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Network Share Discovery utilizing PowerShell. The computer name variable may need to be modified to point to a different host
Upon execution, available network shares will be displayed in the powershell session

Pinned Atomic procedure · 1b0814d1-bb24-402d-9615-1b20c50733fb · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Network Share Discovery utilizing the command prompt. The computer name variable may need to be modified to point to a different host
Upon execution available network shares will be displayed in the powershell session

Pinned Atomic procedure · 20f1097d-81c1-405c-8380-32174d493bbb · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• computer_name: Computer name to find a mount on. (type string; source default localhost)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Network Share Discovery using smbstatus

Pinned Atomic procedure · 77e468a6-3e5c-45a1-9948-c4b5603747cb · linux · sh.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• package_checker: Package checking command. pkg info -x samba (type string; source default (pkg info -x samba &>/dev/null))
• package_installer: Package installer command. pkg install -y samba413 (type string; source default (which pkg && pkg install -y samba413))

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Package with smbstatus (samba) must exist on device

Network Share Discovery using smbstatus

Pinned Atomic procedure · 875805bc-9e86-4e87-be86-3a5527315cae · linux · bash.

Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• package_checker: Package checking command. Debian - dpkg -s samba (type string; source default (rpm -q samba &>/dev/null) || (dpkg -s samba | grep -q installed))
• package_installer: Package installer command. Debian - apt install samba (type string; source default (which yum && yum -y install epel-release samba)||(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y samba))

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Package with smbstatus (samba) must exist on device

Network share enumeration using the shareenumeration function of WinPwn

Pinned Atomic procedure · 987901d1-5b87-4558-a6d9-cffcabc638b8 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

View information about all of the resources that are shared on the local computer Upon execution, available share drives will be displayed in the powershell session

Pinned Atomic procedure · ab39a04f-0c93-4540-9ff2-83f862c385ae · windows · command_prompt.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

Enumerate Domain Shares the current user has access. Upon execution, progress info about each share being scanned will be displayed.

Pinned Atomic procedure · b1636f0a-ba82-435c-b699-0d78794d8bfd · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

No input arguments declared.

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Endpoint must be joined to domain

Snaffler is an open-source tool that has been used by various threat groups, including Scattered Spider/Muddled Libra, to enumerate accessible shares and credential-containing files within a domain. Reference

Pinned Atomic procedure · b19d74b7-5e72-450a-8499-82e49e379d1a · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• output_path: File to output enumeration results to (type String; source default $env:temp\T1135SnafflerOutput.txt)
• snaffler_path: Path to the Snaffler executable (type String; source default PathToAtomicsFolder\..\ExternalPayloads\Snaffler.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• The Snaffler executable must exist on disk

PowerView is a PowerShell tool to gain network situational awareness on Windows domains. ShareFinder finds (non-standard) shares on machines in the domain.

Pinned Atomic procedure · d07e4cc1-98ae-447e-9d31-36cb430d28c4 · windows · powershell.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• parameters: ShareFinder parameter (type string; source default -CheckShareAccess)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• Invoke-ShareFinder module must exist in %TEMP% directory

SharpShares is a command line tool that can be integrated with Cobalt Strike's execute-assembly module, allowing for the enumeration of network shares. This technique has been utilized by various ransomware groups, including BianLian. Reference

Pinned Atomic procedure · d1fa2a69-b0a2-4e8a-9112-529b00c19a41 · windows · powershell.

Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• output_path: File to output enumeration results to (type String; source default $env:temp\T1135SharpSharesOutput.txt)
• sharp_path: Path to the SharpShares executable (type String; source default PathToAtomicsFolder\..\ExternalPayloads\SharpShares.exe)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• The SharpShares executable must exist on disk

Network Share Discovery

Pinned Atomic procedure · f94b5ad9-911c-4eff-9718-fd21899db4f7 · macos · sh.

Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.

Source-defined inputs

• computer_name: Computer name to find a mount on. (type string; source default computer1)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

• M1028 Operating System Configuration

  Enable Windows Group Policy “Do Not Allow Anonymous Enumeration of SAM Accounts and Shares” security setting to limit users who can enumerate network shares.[Windows Anonymous Enumeration of SAM Accounts]