Procedure examples

BlackByte constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.

FIN13 has utilized tools such as Incognito V2 for token manipulation and impersonation.

Mafalda can create a token for a different user.

Cobalt Strike can make tokens from known credentials.

SILENTTRINITY can make tokens from known credentials.

DarkGate relies on parent PID spoofing as part of its "rootkit-like" functionality to evade detection via Task Manager or Process Explorer.

PipeMon can use parent PID spoofing to elevate privileges.

KONNI has used parent PID spoofing to spawn a new `cmd` process using `CreateProcessW` and a handle to `Taskmgr.exe`.

Cobalt Strike can spawn processes with alternate PPIDs.

Empire can add a SID-History to a user if on a domain controller.

Mimikatz's MISC::AddSid module can append any SID or user/group account to a user's SID-History. Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain.

During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.

During Operation CuckooBees, the threat actors used the `net share` command as part of their advanced reconnaissance.

During Operation Wocao, threat actors discovered network disks mounted to the system using netstat.

Leviathan scanned and enumerated remote network shares in victim environments during Leviathan Australian Intrusions.

APT38 has enumerated network shares on a compromised host.

BlackByte enumerated network shares on victim devices.

APT41 used the net share command as part of network reconnaissance.

Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.

APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$.

APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.

Tropic Trooper used netview to scan target systems for shared resources.

APT1 listed connected network shares.

DarkVishnya scanned the network for public shared folders.

Chimera has used net share and net view to identify network shares of interest.

Medusa Group has identified network shares using `cmd.exe /c net share`.

Tonto Team has used tools such as NBTscan to enumerate network shares.

INC Ransom has used Internet Explorer to view folders on other systems.

Sowbug listed remote shared drives that were accessible from a victim.

Wizard Spider has used the “net view” command to locate mapped network shares.

FIN13 has executed net view commands for enumeration of open shares on compromised machines.

TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.

QuietSieve can identify and search networked drives for specific file name extensions.

MURKYTOP has the capability to retrieve information about shares on remote hosts.

Stuxnet enumerates the directories of a network resource.

AvosLocker has enumerated shared drives on a compromised network.

KOPILUWAK can use netstat and Net to discover network shares.

Sardonic has the ability to execute the `net view` command.

RansomHub has the ability to target specific network shares for encryption.

Medusa Ransomware has identified networked drives.

Bad Rabbit enumerates open SMB shares on internal victim networks.

Emotet has enumerated non-hidden network shares using `WNetEnumResourceW`.

Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.

DUSTTRAP can identify and enumerate victim system network shares.

BADHATCH can check a user's access to the C$ share on a compromised machine.

BlackByte 2.0 Ransomware can identify network shares connected to the victim machine.

WastedLocker can identify network adjacent and accessible drives.

InvisiMole can gather network share information.

WhisperGate can enumerate connected remote logical drives.

Conti can enumerate remote open SMB network shares using NetShareEnum().