ATT&CKProcedure examples

Procedure examples

Real-world descriptions of how a group, tool or campaign used a technique.

Technique: T1135×

57 examples

Technique	Used by	Procedure example
T1135 Network Share Discovery	MalwareBitPaymer	BitPaymer can search for network shares on the domain or workgroup using `net view <host>`. Crowdstrike Indrik November 2018
T1135 Network Share Discovery	ToolNet	The `net view \\remotesystem` and `net share` commands in Net can be used to find shared drives and directories on remote and local systems respectively. Savill 1999
T1135 Network Share Discovery	ToolSILENTTRINITY	SILENTTRINITY can enumerate shares on a compromised host. GitHub SILENTTRINITY Modules July 2019
T1135 Network Share Discovery	ToolEmpire	Empire can find shared drives on the local system. Github PowerShell Empire
T1135 Network Share Discovery	ToolCrackMapExec	CrackMapExec can enumerate the shared folders and associated permissions for a targeted network. CME Github September 2018
T1135 Network Share Discovery	ToolKoadic	Koadic can scan local network for open SMB. Github Koadic
T1135 Network Share Discovery	ToolPupy	Pupy can list local and remote shared drives and folders over SMB. GitHub Pupy

First Previous Page 2 of 2

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.