Data from Network Shared Drive T1039

Tactic: Collection

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

Events covered

6 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 14 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (19 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine5regex_match 3, contains 1, in 1, match 1(?i)(((^|\s+)copy|(xcopy|robocopy)(\.exe)?\"?)\s+), cp , mi , move-item, (?i)(Copy\-Item|(^|\s)copy|xcopy(\.exe\"?)?|[^\-]cp|[^\-]...
EventID3eq 34103, 4104, 4688, 5143
OriginalFileName3eq 3net.exe, net1.exe, cmd.exe, powershell.exe, powershell_ise.exe
EventType2eq 2exec, network-share-object-access-checked
Image2ends_with 2, contains 1/mount, /mount_afp, /mount_nfs, \cmd.exe, \powershell.exe
ScriptBlockText2eq 1, in 1dsenumeratedomaintrusts, dsgetsitename, getcomputernameex, invoke-sharefinder, invoke-sharefinderthreaded
event.category2eq 2process
process_name2eq 2net.exe, net1.exe
DACLS1starts_with 1A;
OldSD1ne 1NewSD
Operation1eq 1AddedToSecureLink, AnonymousLinkCreated
RelativeTargetName1ends_with 1.bak, .dmp, .edb
ShareName1in 1\\*\ADMIN$, \\*\C$
Type1eq 1
esf.event_type1eq 19

Top indicator values (99 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
CommandLineregex_match
(?i)(((^|\s+)copy|(xcopy|robocopy)(\.exe)?\"?)\s+)
22
CommandLineregex_match
(?i)(Copy\-Item|(^|\s)copy|xcopy(\.exe\"?)?|[^\-]cp|[^\-]cpi|robocopy(\.exe\"...
1
OriginalFileNameeq
net.exe
228
OriginalFileNameeq
net1.exe
244
event.categoryeq
process
2128
process_nameeq
net.exe
222
process_nameeq
net1.exe
235
CommandLinecontains
cp
18
CommandLinecontains
mi
13
CommandLinecontains
move-item
1
CommandLinecontains
mv
14
CommandLinecontains
\sysvol\
14
CommandLinecontains
copy
15
CommandLinecontains
copy
112
CommandLinecontains
copy-item
16
CommandLinecontains
cpi
15
CommandLinecontains
move
13
CommandLinein
*use *
1
CommandLinein
*view*
1
CommandLinematch
\\\\*\\*$
1
DACLSstarts_with
A;
1
EventIDeq
4103
1105
EventIDeq
4104
1268
EventIDeq
4688
1313
EventIDeq
5143
1
EventTypeeq
exec
1171
EventTypeeq
network-share-object-access-checked
1
Imagecontains
\powershell.exe
1
Imagecontains
\powershell_ise.exe
1
Imagecontains
\pwsh.exe
1

Exclusions (12 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
CommandLineeq
net view \\localhost
1
ScriptBlockTexteq
# copyright: (c) 2018, ansible project
1
ScriptBlockTexteq
#ansiblerequires -csharputil ansible.basic
1
ScriptBlockTexteq
#requires -module ansible.moduleutils.addtype
1
ScriptBlockTexteq
ansible.windows.setup
1
ScriptBlockTexteq
discoverwindowscomputerproperties.ps1
1
ScriptBlockTexteq
dsgetsitename
1
ScriptBlockTexteq
nativemethods.netwkstagetinfo(null, 100, out netbuffer);
1
ScriptBlockTexteq
param($sourcetype, $sourceid, $managedentityid, $computeridentity)
1
file.directoryeq
C:\Program Files (x86)\Automox\WDK\Win32\WinSession
1
shareeq
allowed_shares
1
user.ideq
S-1-5-18
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 3 rules

Elastic 5 rules

Splunk 4 rules

Kusto 1 rule

Panther 1 rule