Cross-source coverage

T1135 / ATT&CK

Network Share Discovery

32 rules across 7 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

File sharing over a Windows network occurs over the SMB protocol. Net can be used to query a remote system for available shared drives using the net view \\\\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services.

Tactics
Discovery
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:PowerShelletw:Microsoft-Windows-RPCauditd:SYSCALLNSM:Flowmacos:endpointsecuritymacos:unifiedlogNSM:Firewall

How MITRE says to detect it DET0182

Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS

Windows Analytic 0513

Process or script enumerates network shares via CLI (net view/net share, PowerShell Get-SmbShare/WMI) or OS APIs (NetShareEnum/ srvsvc.NetShareEnumAll RPC) → bursts of outbound SMB/RPC connections (445/139, \\host\IPC$ / srvsvc) to many hosts inside a short window → optional follow-on file listing or copy operations.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Sysmon EventCode=17
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
  • etw:Microsoft-Windows-RPC rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes

Linux Analytic 0514

CLI tools (smbclient -L, smbmap, rpcclient, nmblookup) or custom scripts enumerate SMB shares on many internal hosts → corresponding SMB connections (445/139) captured by Zeek/Netflow within a short window.

  • auditd:SYSCALL execve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb
  • NSM:Flow connection: TCP connections to ports 139/445 to multiple hosts
  • NSM:Flow smb_command: TreeConnectAndX to \\*\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares

macOS Analytic 0515

Use of native/mac tools (sharing -l, smbutil view, mount_smbfs) or scripts to enumerate SMB shares across many hosts, followed by outbound SMB connections observed in PF/Zeek logs.

  • macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC: Process execution of "sharing -l", "smbutil view", "mount_smbfs"
  • macos:unifiedlog Command line contains smbutil view //, mount_smbfs //
  • NSM:Firewall Outbound connections to 139/445 to multiple destinations
  • NSM:Flow connection: SMB connections to multiple internal hosts

View on attack.mitre.org ↗

socfortress/Wazuh-Rules

10 rules
Detection Severity Format
Network Share Discovery attempt detected via smbstatus High Wazuh XML
Sysmon - Event 1: Process creation · dir ip for share discovery (T1135) High Wazuh XML
Sysmon - Event 1: Process creation · get-smbshare PowerShell cmdlet (T1135) High Wazuh XML
Sysmon - Event 1: Process creation · net share usage (T1135) High Wazuh XML
Sysmon - Event 1: Process creation · net view usage (T1135) High Wazuh XML
Sysmon - Event 1: Process creation · PowerView Find-DomainShare (T1135) High Wazuh XML
Sysmon - Event 1: Process creation · PowerView Invoke-ShareFinder (T1135) High Wazuh XML
Sysmon - Event 1: Process creation · SharpShares.exe execution (T1135) High Wazuh XML
Sysmon - Event 1: Process creation · Snaffler.exe execution (T1135) High Wazuh XML
Sysmon - Event 1: Process creation · WinPwn shareenumeration (T1135) High Wazuh XML

splunk/security_content

8 rules
Detection Severity Format
Advanced IP or Port Scanner Execution Undefined SPL
MacOS Network Share Discovery Undefined SPL
Network Share Discovery Via Dir Command Undefined SPL
Windows Administrative Shares Accessed On Multiple Hosts Undefined SPL
Windows File Share Discovery With Powerview Undefined SPL
Windows Large Number of Computer Service Tickets Requested Undefined SPL
Windows Network Share Interaction Via Net Undefined SPL
Windows Special Privileged Logon On Multiple Hosts Undefined SPL

SigmaHQ/sigma

7 rules
Detection Severity Format
Potential Dridex Activity Critical Sigma
Turla Group Lateral Movement Critical Sigma
File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell High Sigma
HackTool - SharpView Execution High Sigma
PUA - Advanced IP Scanner Execution Medium Sigma
PUA - Advanced Port Scanner Execution Medium Sigma
Net.EXE Execution Low Sigma

elastic/detection-rules

3 rules
Detection Severity Format
PowerShell Share Enumeration Script High Elastic TOML
Manual Mount Discovery via /etc/exports or /etc/fstab Medium Elastic TOML
PowerShell Suspicious Discovery Related Windows API Functions Low Elastic TOML

Wazuh Core Ruleset

2 rules
Detection Severity Format
A net.exe domain discovery command was executed Low Wazuh XML
Discovery activity spawned via cmd shell execution Low Wazuh XML

chronicle/detection-rules

1 rule
Detection Severity Format
detect_enumeration_via_wmi Undefined YARA-L

elastic/protections-artifacts

1 rule
Detection Severity Format
Distributed File System Shares Enumeration via LDAP Undefined Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.