Procedure examples

Diavol has a `ENMDSKS` command to enumerates available network shares.

BlackCat has the ability to discover network shares on compromised networks.

IcedID has used the `net view /all` command to show available shares.

ShimRat can enumerate connected drives for infected host machines.

Avaddon has enumerated shared folders and mapped volumes.

Flagpro has been used to execute `net view` to discover mapped network shares.

HELLOKITTY has the ability to enumerate network resources.

Babuk has the ability to enumerate network shares.

PlugX has a module to enumerate network shares.

Cuba can discover shared resources using the NetShareEnum API call.

DEATHRANSOM has the ability to use loop operations to enumerate network resources.

Clambling has the ability to enumerate network shares.

Akira can identify remote file shares for encryption.

LockBit 3.0 can identify network shares on compromised systems.

Latrodectus can run `C:\Windows\System32\cmd.exe /c net view /all` to discover network shares.

Royal can enumerate the shared resources of a given IP addresses using the API call `NetShareEnum`.

Embargo has searched for folders, subfolders and other networked or mounted drives for follow-on encryption actions.

BlackByte Ransomware can identify network shares connected to the victim machine.

Bazar can enumerate shared drives on the domain.

LockBit 2.0 can discover remote shares.

Zebrocy identifies network drives when they are added to victim systems.

Cobalt Strike can query shared drives on the local system.

Ramsay can scan for network drives which may contain documents for collection.

Kwampirs collects a list of network shares with the command net share.

Clop can enumerate network shares.

LunarWeb can identify shared resources in compromised environments.

Qilin has the ability to list network drives.

QakBot can use net share to identify network shares for use in lateral movement.

INC Ransomware has the ability to check for shared network drives to encrypt.

FIVEHANDS can enumerate network shares and mounted drives on a network.

OSInfo discovers shares on the network

BitPaymer can search for network shares on the domain or workgroup using net view <host>.

The net view \\remotesystem and net share commands in Net can be used to find shared drives and directories on remote and local systems respectively.

SILENTTRINITY can enumerate shares on a compromised host.

Empire can find shared drives on the local system.

CrackMapExec can enumerate the shared folders and associated permissions for a targeted network.

Koadic can scan local network for open SMB.

Pupy can list local and remote shared drives and folders over SMB.

During the 2016 Ukraine Electric Power Attack, Sandworm Team added a login to a SQL Server with `sp_addlinkedsrvlogin`.

Indrik Spider used wmic.exe to add a new user to the system.

Salt Typhoon has created Linux-level users on compromised network devices through modification of `/etc/shadow` and `/etc/passwd`.

Scattered Spider creates new user identities within the compromised organization.

LockBit 2.0 has been observed creating accounts for persistence using simple names like "a".

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to create a local backdoor account to maintain access.

Indrik Spider has created local system accounts and has added the accounts to privileged groups.

APT3 has been known to create or enable accounts, such as support_388945a0.

Kimsuky has created accounts with net user.

APT41 has created user accounts.

Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.

Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.