Procedure examples

APT38 has enumerated network shares on a compromised host.

BlackByte enumerated network shares on victim devices.

APT41 used the net share command as part of network reconnaissance.

Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.

APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$.

APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.

Tropic Trooper used netview to scan target systems for shared resources.

APT1 listed connected network shares.

DarkVishnya scanned the network for public shared folders.

Chimera has used net share and net view to identify network shares of interest.

Medusa Group has identified network shares using `cmd.exe /c net share`.

Tonto Team has used tools such as NBTscan to enumerate network shares.

INC Ransom has used Internet Explorer to view folders on other systems.

Sowbug listed remote shared drives that were accessible from a victim.

Wizard Spider has used the “net view” command to locate mapped network shares.

FIN13 has executed net view commands for enumeration of open shares on compromised machines.