T1135.md

T1135 - Network Share Discovery

Description from ATT&CK

Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

Windows

File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder)

Net can be used to query a remote system for available shared drives using the net view \remotesystem command. It can also be used to query shared drives on the local system using net share.

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

Mac

On Mac, locally mounted shares can be viewed with the df -aH command.

Cloud

Cloud virtual networks may contain remote network shares or file storage services accessible to an adversary after they have obtained access to a system. For example, AWS, GCP, and Azure support creation of Network File System (NFS) shares and Server Message Block (SMB) shares that may be mapped on endpoint or cloud-based systems.(Citation: Amazon Creating an NFS File Share)(Citation: Google File servers on Compute Engine)

Atomic Tests

• Atomic Test #1 - Network Share Discovery

• Atomic Test #2 - Network Share Discovery command prompt

• Atomic Test #3 - Network Share Discovery PowerShell

• Atomic Test #4 - View available share drives

Atomic Test #1 - Network Share Discovery

Network Share Discovery

Supported Platforms: macOS, Linux

Inputs:

Name	Description	Type	Default Value
computer_name	Computer name to find a mount on.	string	computer1

Attack Commands: Run with sh!

df -aH
smbutil view -g //#{computer_name}
showmount #{computer_name}

Atomic Test #2 - Network Share Discovery command prompt

Network Share Discovery utilizing the command prompt

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
computer_name	Computer name to find a mount on.	string	localhost

Attack Commands: Run with command_prompt!

net view \\#{computer_name}

Atomic Test #3 - Network Share Discovery PowerShell

Network Share Discovery utilizing PowerShell

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
computer_name	Computer name to find a mount on.	string	localhost

Attack Commands: Run with powershell!

net view \\#{computer_name}
get-smbshare -Name #{computer_name}

Atomic Test #4 - View available share drives

View information about all of the resources that are shared on the local computer Supported Platforms: Windows

Attack Commands: Run with command_prompt!

net share