Data from Network Shared Drive T1039
Tactic: Collection
Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
Events covered
6 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Security-Auditing | Event ID 5143 | A network share object was modified. |
| Security-Auditing | Event ID 5145 | A network share object was checked to see whether client can be granted desired access. |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Authoring guide
These 15 rules share fields, values, and exclusions.
Fields filtered most (19 distinct)
These fields appear most often in rule filters.
Top indicator values (104 distinct)
These values appear most often in rule predicates.
Exclusions (11 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 3 rules
- Copy From Or To Admin Share Or Sysvol Folder
- macOS Network Share Access
- Suspicious Access to Sensitive File Extensions
Elastic 6 rules
- First Time Seen NFS AUTH_SYS Root UID Access
- Potential Network Share Discovery
- PowerShell Share Enumeration Script
- PowerShell Suspicious Discovery Related Windows API Functions
- Unusual Remote File Size
- Windows Network Enumeration
Splunk 4 rules
- Windows Copy Files (PowerShell)
- Windows Copy Files (Sysmon)
- Windows Copy Files (Windows Event Log)
- Windows Network Share Interaction Via Net