Procedure examples

TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.

QuietSieve can identify and search networked drives for specific file name extensions.

MURKYTOP has the capability to retrieve information about shares on remote hosts.

Stuxnet enumerates the directories of a network resource.

AvosLocker has enumerated shared drives on a compromised network.

KOPILUWAK can use netstat and Net to discover network shares.

Sardonic has the ability to execute the `net view` command.

RansomHub has the ability to target specific network shares for encryption.

Medusa Ransomware has identified networked drives.

Bad Rabbit enumerates open SMB shares on internal victim networks.

Emotet has enumerated non-hidden network shares using `WNetEnumResourceW`.

Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.

DUSTTRAP can identify and enumerate victim system network shares.

BADHATCH can check a user's access to the C$ share on a compromised machine.

BlackByte 2.0 Ransomware can identify network shares connected to the victim machine.

WastedLocker can identify network adjacent and accessible drives.

InvisiMole can gather network share information.

WhisperGate can enumerate connected remote logical drives.

Conti can enumerate remote open SMB network shares using NetShareEnum().

Diavol has a `ENMDSKS` command to enumerates available network shares.

BlackCat has the ability to discover network shares on compromised networks.

IcedID has used the `net view /all` command to show available shares.

ShimRat can enumerate connected drives for infected host machines.

Avaddon has enumerated shared folders and mapped volumes.

Flagpro has been used to execute `net view` to discover mapped network shares.

HELLOKITTY has the ability to enumerate network resources.

Babuk has the ability to enumerate network shares.

PlugX has a module to enumerate network shares.

Cuba can discover shared resources using the NetShareEnum API call.

DEATHRANSOM has the ability to use loop operations to enumerate network resources.

Clambling has the ability to enumerate network shares.

Akira can identify remote file shares for encryption.

LockBit 3.0 can identify network shares on compromised systems.

Latrodectus can run `C:\Windows\System32\cmd.exe /c net view /all` to discover network shares.

Royal can enumerate the shared resources of a given IP addresses using the API call `NetShareEnum`.

Embargo has searched for folders, subfolders and other networked or mounted drives for follow-on encryption actions.

BlackByte Ransomware can identify network shares connected to the victim machine.

Bazar can enumerate shared drives on the domain.

LockBit 2.0 can discover remote shares.

Zebrocy identifies network drives when they are added to victim systems.

Cobalt Strike can query shared drives on the local system.

Ramsay can scan for network drives which may contain documents for collection.

Kwampirs collects a list of network shares with the command net share.

Clop can enumerate network shares.

LunarWeb can identify shared resources in compromised environments.

Qilin has the ability to list network drives.

QakBot can use net share to identify network shares for use in lateral movement.

INC Ransomware has the ability to check for shared network drives to encrypt.

FIVEHANDS can enumerate network shares and mounted drives on a network.

OSInfo discovers shares on the network