MITRE ATT&CKtechnique
T1039 Data from Network Shared Drive
- Domain
- enterprise
- Tactics
- Collection
- Platforms
- Linux, macOS, Windows
- Version
- 1.6
- Created
- 2017-05-31
Description
Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
Related
Tactic · MITRE ATT&CK (1)
- TA0009 Collection tactic
Referenced by MITRE ATT&CK · uses (14)
- G1059 NIMBUS MANTICORE group
- G1039 RedCurl group
- C0015 C0015 campaign
- S0554 Egregor software (malware)
- G0117 Fox Kitten group
- G0114 Chimera group
- S0458 Ramsay software (malware)
- G0054 Sowbug group
- G0060 BRONZE BUTLER group
- G0007 APT28 group
- G0045 menuPass group
- G0047 Gamaredon Group group
- S0050 CosmicDuke software (malware)
- S0128 BADNEWS software (malware)
Referenced by CAPEC · att&ck technique (1)
- CAPEC-639 Probe System Files attack pattern
References
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/gg651155(v=ws.11) Net Use
- https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF Cybersecurity Advisory GRU Brute Force Campaign July 2021