Cross-source coverage
T1039 / ATT&CK
Data from Network Shared Drive
10 rules across 5 sources.
From MITRE ATT&CK 19.2
Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
- Tactics
- Collection
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:syslogmacos:unifiedlogfs:fsusage
How MITRE says to detect it DET0410
Detection Strategy for Data from Network Shared Drive
Windows Analytic 1145
Monitoring of file access to network shares (e.g., C$, Admin$) followed by unusual read or copy operations by processes not typically associated with such activity (e.g., PowerShell, certutil).
WinEventLog:SecurityEventCode=5145WinEventLog:SysmonEventCode=11
Linux Analytic 1146
Unusual access or copying of files from mounted network drives (e.g., NFS, CIFS/SMB) by user shells or scripts followed by large data transfer.
auditd:SYSCALLopen,readlinux:syslogmount/umount or file copy logs
macOS Analytic 1147
Detection of file access from mounted SMB shares followed by copy or exfil commands from Terminal or script interpreter processes.
macos:unifiedlogfilesystem and process eventsfs:fsusageopen/read/mount operations
elastic/detection-rules
4 rules| Detection | Severity | Format |
|---|---|---|
| PowerShell Share Enumeration Script | High | Elastic TOML |
| First Time Seen NFS AUTH_SYS Root UID Access | Medium | Elastic TOML |
| PowerShell Suspicious Discovery Related Windows API Functions | Low | Elastic TOML |
| Unusual Remote File Size | Low | Elastic TOML |
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| Copy From Or To Admin Share Or Sysvol Folder | Medium | Sigma |
| Suspicious Access to Sensitive File Extensions | Medium | Sigma |
socfortress/Wazuh-Rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Sysmon - Event 1: Process creation · CMD copy Admin Share (T1039) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · PowerShell copy-item Admin Share (T1039) | High | Wazuh XML |
panther-labs/panther-analysis
1 rule| Detection | Severity | Format |
|---|---|---|
| Microsoft365 External Document Sharing | Low | Panther Python |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Windows Network Share Interaction Via Net | Undefined | SPL |