Procedure examples

LockBit 3.0 can identify network shares on compromised systems.

Latrodectus can run `C:\Windows\System32\cmd.exe /c net view /all` to discover network shares.

Royal can enumerate the shared resources of a given IP addresses using the API call `NetShareEnum`.

Embargo has searched for folders, subfolders and other networked or mounted drives for follow-on encryption actions.

BlackByte Ransomware can identify network shares connected to the victim machine.

Bazar can enumerate shared drives on the domain.

LockBit 2.0 can discover remote shares.

Zebrocy identifies network drives when they are added to victim systems.

Cobalt Strike can query shared drives on the local system.

Ramsay can scan for network drives which may contain documents for collection.

Kwampirs collects a list of network shares with the command net share.

Clop can enumerate network shares.

LunarWeb can identify shared resources in compromised environments.

Qilin has the ability to list network drives.

QakBot can use net share to identify network shares for use in lateral movement.

INC Ransomware has the ability to check for shared network drives to encrypt.

FIVEHANDS can enumerate network shares and mounted drives on a network.

OSInfo discovers shares on the network

BitPaymer can search for network shares on the domain or workgroup using net view <host>.

The net view \\remotesystem and net share commands in Net can be used to find shared drives and directories on remote and local systems respectively.

SILENTTRINITY can enumerate shares on a compromised host.

Empire can find shared drives on the local system.

CrackMapExec can enumerate the shared folders and associated permissions for a targeted network.

Koadic can scan local network for open SMB.

Pupy can list local and remote shared drives and folders over SMB.

LockBit 2.0 has been observed creating accounts for persistence using simple names like "a".

Hildegard has created a user named “monerodaemon”.

S-Type may create a temporary user on the system named `Lost_{Unique Identifier}` with the password `pond~!@6”{Unique Identifier}`.

DarkGate creates a local user account, SafeMode, via net user commands.

Carbanak can create a Windows account.

SMOKEDHAM has created user accounts.

ServHelper has created a new user named "supportaccount".

Calisto has the capability to add its own account to the victim's machine.

GoldenSpy can create new users on an infected system.

ZxShell has a feature to create local user accounts.

Mis-Type may create a temporary user on the system named `Lost_{Unique Identifier}`.

HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.

The net user username \password commands in Net can be used to create a local account.

Empire has a module for creating a local user if permissions allow.

Pupy can user PowerView to execute “net user” commands and create local system accounts.

Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.

The net user username \password \domain commands in Net can be used to create a domain account.

Empire has a module for creating a new domain user if permissions allow.

Pupy can user PowerView to execute “net user” commands and create domain accounts.

PsExec has the ability to remotely create accounts on target systems.

AADInternals can create new Azure AD users.

ROAMINGHOUSE has been loaded as a Word Template file when victims opened a decoy document placed in `%APPDATA%\Microsoft\Templates` alongside a ROAMINGHOUSE macro.

Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.

BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.

Ruler can be used to automate the abuse of Outlook Forms to establish persistence.