Technique.View on attack.mitre.org
Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
Rules on DetectionCode tagged with T1039.
| Rule | Level | Log source |
|---|---|---|
| Copy From Or To Admin Share Or Sysvol Folder | medium | windows / process_creation |
| Suspicious Access to Sensitive File Extensions | medium | windows / NULL |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Windows Network Share Interaction Via Net | Hunting | NULL | Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2 |
| Windows Network Share Interaction With Net | TTP | NULL | Sysmon EventID 1 |
| Used by | Procedure example |
|---|---|
| GroupAPT28 | APT28 has collected files from network shared drives. |
| GroupBRONZE BUTLER | BRONZE BUTLER has exfiltrated files stolen from file shares. |
| GroupChimera | Chimera has collected data of interest from network shares. |
| GroupFox Kitten | Fox Kitten has searched network shares to access sensitive documents. |
| GroupGamaredon Group | Gamaredon Group malware has collected Microsoft Office documents from mapped network drives. |
| GroupmenuPass | menuPass has collected data from remote systems by mounting network shares with |
| GroupRedCurl | RedCurl has collected data about network drives. |
| GroupSowbug | Sowbug extracted Word documents from a file server on a victim network. |
| Used by | Procedure example |
|---|---|
| MalwareBADNEWS | When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt. |
| MalwareCosmicDuke | CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list. |
| MalwareEgregor | Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel. |
| MalwareRamsay | Ramsay can collect data from network drives and stage it for exfiltration. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
