Techniques › T1135
T1135 Network Share Discovery
discovery — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
7
Sigma rules tagged attack.t1135
0
KEV CVEs mapped here
<p>Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.</p><p>File sharing over a Windows network occurs over the SMB protocol. Net can be used to query a remote system for available shared drives using the <code>net view \\\\remotesystem</code> command. It can also be used to query shared drives on the local system using <code>net share</code>. For macOS, the <code>sharing -l</code> command lists all shared points used for smb services.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0182 Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS v1.0
AN0513 WindowsProcess or script enumerates network shares via CLI (net view/net share, PowerShell Get-SmbShare/WMI) or OS APIs (NetShareEnum/ srvsvc.NetShareEnumAll RPC) → bursts of outbound SMB/RPC connections (445/139, \\host\IPC$ / srvsvc) to many hosts inside a short window → optional follow-on file listing or copy operations.etw:Microsoft-Windows-RPC
rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes→ DC0021 OS API ExecutionTunable:BurstHostThresholdTimeWindowAllowedDiscoveryAccountsPipeNameAllowListAN0514 LinuxCLI tools (smbclient -L, smbmap, rpcclient, nmblookup) or custom scripts enumerate SMB shares on many internal hosts → corresponding SMB connections (445/139) captured by Zeek/Netflow within a short window.auditd:SYSCALLexecve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb→ DC0032 Process CreationNSM:Flowconnection: TCP connections to ports 139/445 to multiple hosts→ DC0082 Network Connection CreationNSM:Flowsmb_command: TreeConnectAndX to \\*\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares→ DC0021 OS API ExecutionTunable:BurstHostThresholdTimeWindowApprovedInventoryHostsAN0515 macOSUse of native/mac tools (sharing -l, smbutil view, mount_smbfs) or scripts to enumerate SMB shares across many hosts, followed by outbound SMB connections observed in PF/Zeek logs.macos:endpointsecurityES_EVENT_TYPE_NOTIFY_EXEC: Process execution of "sharing -l", "smbutil view", "mount_smbfs"→ DC0032 Process CreationNSM:Flowconnection: SMB connections to multiple internal hosts→ DC0082 Network Connection CreationTunable:BurstHostThresholdTimeWindowAllowedMgmtTools
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1135
Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)
· 2019-01-16 (modified 2022-07-11) · logsource: product=windows category=process_creation · 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
Detects execution of "Net.EXE".
Author: Nasreddine Bencherchali (Nextron Systems)
· 2021-12-18 (modified 2023-02-07) · logsource: product=windows category=process_creation · 54773c5f-f1cc-4703-9126-2f797d96a69d
Detects the use of Advanced Port Scanner.
Author: frack113
· 2021-12-10 (modified 2023-02-14) · logsource: product=windows category=process_creation · b2317cfa-4a47-4ead-b3ff-297438c0bc2d
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Author: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy
· 2020-05-12 (modified 2023-02-07) · logsource: product=windows category=process_creation · bef37fa2-f205-4a7b-b484-0759bfd5f86f
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Author: @Kostastsale
· 2022-12-22 (modified 2024-08-23) · logsource: product=windows category=process_creation · c3d76afc-93df-461e-8e67-9b2bad3f2ac4
Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.
Author: Markus Neis
· 2017-11-07 (modified 2022-10-09) · logsource: product=windows category=process_creation · c601f20d-570a-4cde-a7d6-e17f99cb8e7f
Detects automated lateral movement by Turla group
Author: Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2019-01-10 (modified 2023-02-03) · logsource: product=windows category=process_creation · e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e
Detects potential Dridex acitvity via specific process patterns