Description
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) Net can be used to query a remote system for available shared drives using the net view \\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services.
Platforms
Mitigations (1)
Operating System ConfigurationM1028
Enable Windows Group Policy “Do Not Allow Anonymous Enumeration of SAM Accounts and Shares” security setting to limit users who can enumerate network shares.(Citation: Windows Anonymous Enumeration of SAM Accounts)
Threat Groups (16)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has enumerated network shares on a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020) |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) enumerated network shares on victim devices.(Citation: Cisco BlackByte 2024) |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used the <code>net share</code> command as part of network reconnaissance.(Citation: FireEye APT41 Aug... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has identified and browsed file servers in the victim network, sometimes , viewing files pertaining... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) used the <code>net view</code> command to show all shares available, including the administrative share... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used the post exploitation tool [CrackMapExec](https://attack.mitre.org/software/S0488) to enumerat... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) used <code>netview</code> to scan target systems for shared resources.(Citation: TrendMicro Tr... |
| G0006 | APT1 | [APT1](https://attack.mitre.org/groups/G0006) listed connected network shares.(Citation: Mandiant APT1) |
| G0105 | DarkVishnya | [DarkVishnya](https://attack.mitre.org/groups/G0105) scanned the network for public shared folders.(Citation: Securelist DarkVishnya Dec 2018) |
| G0114 | Chimera | [Chimera](https://attack.mitre.org/groups/G0114) has used <code>net share</code> and <code>net view</code> to identify network shares of interest.(Cit... |
| G1051 | Medusa Group | [Medusa Group](https://attack.mitre.org/groups/G1051) has identified network shares using `cmd.exe /c net share`.(Citation: CISA Medusa Group Medusa R... |
| G0131 | Tonto Team | [Tonto Team](https://attack.mitre.org/groups/G0131) has used tools such as [NBTscan](https://attack.mitre.org/software/S0590) to enumerate network sha... |
| G1032 | INC Ransom | [INC Ransom](https://attack.mitre.org/groups/G1032) has used Internet Explorer to view folders on other systems.(Citation: Huntress INC Ransom Group A... |
| G0054 | Sowbug | [Sowbug](https://attack.mitre.org/groups/G0054) listed remote shared drives that were accessible from a victim.(Citation: Symantec Sowbug Nov 2017) |
| G0102 | Wizard Spider | [Wizard Spider](https://attack.mitre.org/groups/G0102) has used the “net view” command to locate mapped network shares.(Citation: DHS/CISA Ransomware ... |
| G1016 | FIN13 | [FIN13](https://attack.mitre.org/groups/G1016) has executed net view commands for enumeration of open shares on compromised machines.(Citation: Mandia... |
Associated Software (57)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.(Citation: ESET Trick... |
| S0686 | QuietSieve | Malware | [QuietSieve](https://attack.mitre.org/software/S0686) can identify and search networked drives for specific file name extensions.(Citation: Microsoft ... |
| S0233 | MURKYTOP | Malware | [MURKYTOP](https://attack.mitre.org/software/S0233) has the capability to retrieve information about shares on remote hosts.(Citation: FireEye Perisco... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) enumerates the directories of a network resource.(Citation: Nicolas Falliere, Liam O Murchu, Eric C... |
| S1053 | AvosLocker | Malware | [AvosLocker](https://attack.mitre.org/software/S1053) has enumerated shared drives on a compromised network.(Citation: Malwarebytes AvosLocker Jul 202... |
| S1075 | KOPILUWAK | Malware | [KOPILUWAK](https://attack.mitre.org/software/S1075) can use [netstat](https://attack.mitre.org/software/S0104) and [Net](https://attack.mitre.org/sof... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) has the ability to execute the `net view` command.(Citation: Bitdefender Sardonic Aug 2021) |
| S1212 | RansomHub | Malware | [RansomHub](https://attack.mitre.org/software/S1212) has the ability to target specific network shares for encryption.(Citation: Group-IB RansomHub FE... |
| S1244 | Medusa Ransomware | Malware | [Medusa Ransomware](https://attack.mitre.org/software/S1244) has identified networked drives.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomwa... |
| S0606 | Bad Rabbit | Malware | [Bad Rabbit](https://attack.mitre.org/software/S0606) enumerates open SMB shares on internal victim networks.(Citation: ESET Bad Rabbit) |
| S0367 | Emotet | Malware | [Emotet](https://attack.mitre.org/software/S0367) has enumerated non-hidden network shares using `WNetEnumResourceW`. (Citation: Binary Defense Emotes... |
| S0365 | Olympic Destroyer | Malware | [Olympic Destroyer](https://attack.mitre.org/software/S0365) will attempt to enumerate mapped network shares to later attempt to wipe all files on tho... |
| S1159 | DUSTTRAP | Malware | [DUSTTRAP](https://attack.mitre.org/software/S1159) can identify and enumerate victim system network shares.(Citation: Google Cloud APT41 2024) |
| S1081 | BADHATCH | Malware | [BADHATCH](https://attack.mitre.org/software/S1081) can check a user's access to the C$ share on a compromised machine.(Citation: BitDefender BADHATCH... |
| S1181 | BlackByte 2.0 Ransomware | Malware | [BlackByte 2.0 Ransomware](https://attack.mitre.org/software/S1181) can identify network shares connected to the victim machine.(Citation: Microsoft B... |
| S0612 | WastedLocker | Malware | [WastedLocker](https://attack.mitre.org/software/S0612) can identify network adjacent and accessible drives.(Citation: Sentinel Labs WastedLocker July... |
| S0260 | InvisiMole | Malware | [InvisiMole](https://attack.mitre.org/software/S0260) can gather network share information.(Citation: ESET InvisiMole June 2018) |
| S0689 | WhisperGate | Malware | [WhisperGate](https://attack.mitre.org/software/S0689) can enumerate connected remote logical drives.(Citation: Cisco Ukraine Wipers January 2022) |
| S0575 | Conti | Malware | [Conti](https://attack.mitre.org/software/S0575) can enumerate remote open SMB network shares using <code>NetShareEnum()</code>.(Citation: CarbonBlack... |
| S0659 | Diavol | Malware | [Diavol](https://attack.mitre.org/software/S0659) has a `ENMDSKS` command to enumerates available network shares.(Citation: Fortinet Diavol July 2021)... |
References
- Microsoft. (n.d.). Share a Folder or Drive. Retrieved June 30, 2017.
- Wikipedia. (2017, April 15). Shared resource. Retrieved June 30, 2017.
Frequently Asked Questions
What is T1135 (Network Share Discovery)?
T1135 is a MITRE ATT&CK technique named 'Network Share Discovery'. It belongs to the Discovery tactic(s). Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of inter...
How can T1135 be detected?
Detection of T1135 (Network Share Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1135?
There are 1 documented mitigations for T1135. Key mitigations include: Operating System Configuration.
Which threat groups use T1135?
Known threat groups using T1135 include: APT38, BlackByte, APT41, Dragonfly, APT32, APT39, Tropic Trooper, APT1.