MITRE ATT&CKtechnique

T1135 Network Share Discovery

Published 2017-12-14 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
Linux, macOS, Windows
Version
3.2
Created
2017-12-14

Description

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. Net can be used to query a remote system for available shared drives using the net view \\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1028 Operating System Configuration mitigation

Referenced by MITRE ATT&CK · uses (79)

  • S9051 The Gentlemen Ransomware software (malware)
  • S9045 BACKUPOSINT v9.0 APEX PREDATOR software (malware)
  • S1247 Embargo software (malware)
  • S1244 Medusa Ransomware software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1212 RansomHub software (malware)
  • S1202 LockBit 3.0 software (malware)
  • C0049 Leviathan Australian Intrusions campaign
  • S1199 LockBit 2.0 software (malware)
  • S1180 BlackByte Ransomware software (malware)
  • S1181 BlackByte 2.0 Ransomware software (malware)
  • G1043 BlackByte group
  • S1159 DUSTTRAP software (malware)
  • S1160 Latrodectus software (malware)
  • S1141 LunarWeb software (malware)
  • G1032 INC Ransom group
  • S1139 INC Ransomware software (malware)
  • S1129 Akira software (malware)
  • S1085 Sardonic software (malware)
  • S1081 BADHATCH software (malware)
  • G1016 FIN13 group
  • S1075 KOPILUWAK software (malware)
  • S1073 Royal software (malware)
  • S1068 BlackCat software (malware)
  • S1053 AvosLocker software (malware)
  • C0015 C0015 campaign
  • C0014 Operation Wocao campaign
  • C0012 Operation CuckooBees campaign
  • S0696 Flagpro software (malware)
Show all 79 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-643 Identify Shared Files/Directories on System attack pattern

Referenced by Compliance · mitigates (3)

  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References