Cross-source coverage

T1039 / ATT&CK

Data from Network Shared Drive

10 rules across 5 sources.

From MITRE ATT&CK 19.2

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

Tactics
Collection
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:syslogmacos:unifiedlogfs:fsusage

How MITRE says to detect it DET0410

Detection Strategy for Data from Network Shared Drive

Windows Analytic 1145

Monitoring of file access to network shares (e.g., C$, Admin$) followed by unusual read or copy operations by processes not typically associated with such activity (e.g., PowerShell, certutil).

  • WinEventLog:Security EventCode=5145
  • WinEventLog:Sysmon EventCode=11

Linux Analytic 1146

Unusual access or copying of files from mounted network drives (e.g., NFS, CIFS/SMB) by user shells or scripts followed by large data transfer.

  • auditd:SYSCALL open,read
  • linux:syslog mount/umount or file copy logs

macOS Analytic 1147

Detection of file access from mounted SMB shares followed by copy or exfil commands from Terminal or script interpreter processes.

  • macos:unifiedlog filesystem and process events
  • fs:fsusage open/read/mount operations

elastic/detection-rules

4 rules
Detection Severity Format
PowerShell Share Enumeration Script High Elastic TOML
First Time Seen NFS AUTH_SYS Root UID Access Medium Elastic TOML
PowerShell Suspicious Discovery Related Windows API Functions Low Elastic TOML
Unusual Remote File Size Low Elastic TOML

SigmaHQ/sigma

2 rules
Detection Severity Format
Copy From Or To Admin Share Or Sysvol Folder Medium Sigma
Suspicious Access to Sensitive File Extensions Medium Sigma

socfortress/Wazuh-Rules

2 rules
Detection Severity Format
Sysmon - Event 1: Process creation · CMD copy Admin Share (T1039) High Wazuh XML
Sysmon - Event 1: Process creation · PowerShell copy-item Admin Share (T1039) High Wazuh XML

panther-labs/panther-analysis

1 rule
Detection Severity Format
Microsoft365 External Document Sharing Low Panther Python

splunk/security_content

1 rule
Detection Severity Format
Windows Network Share Interaction Via Net Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.