tfMITRE ATT&CK technique

Data from Network Shared Drive T1039

Tactic: Collection
Platforms: Linux, macOS, Windows
Version: 1.5
Created: 31 May 2017
Last modified: 24 October 2025
Contributor: David Tayouri

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 21%

Threat groups79th percentile · 79% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Data from Network Shared Drive MITRE reference T1039

Top 21%of all ATT&CK techniques for number of groups

8 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

RedCurlG1039 ↗

Has collected data about network drives.1 2

created 2024-09-232 references

Fox KittenG0117 ↗

Has searched network shares to access sensitive documents.1

created 2020-12-211 referenceaka UNC757

ChimeraG0114 ↗

Has collected data of interest from network shares.1

created 2020-08-241 reference

BRONZE BUTLERG0060 ↗

Has exfiltrated files stolen from file shares.1

created 2018-01-161 referenceaka REDBALDKNIGHT

SowbugG0054 ↗

Extracted Word documents from a file server on a victim network.1

created 2018-01-161 reference

Gamaredon GroupG0047 ↗

Malware has collected Microsoft Office documents from mapped network drives.1 2

created 2017-05-312 referencesaka IRON TILDEN

All 8 groups for this technique · 6 newest in this preview

Offense vs defense T1039

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 1

first rule: 2019 Q2 · 1 of 1 campaigns plotted

Data from Network Shared Drive detection strategy DET0410

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Data from Network Shared Drive

Enterprise

3 platforms

AN1145 · Windows

Monitoring of file access to network shares (e.g., C$, Admin$) followed by unusual read or copy operations by processes not typically associated with such activity (e.g., PowerShell, certutil).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Share AccessDC0102	WinEventLog:Security	EventCode=5145

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ShareName	Organizations may use custom share paths outside of default C$, Admin$, etc.
ProcessName	Common toolsets vary; defenders should tailor to unusual processes for their environment.
TimeWindow	Time of day and access duration may need to be tuned to reduce false positives.

AN1146 · Linux

Unusual access or copying of files from mounted network drives (e.g., NFS, CIFS/SMB) by user shells or scripts followed by large data transfer.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Drive AccessDC0054	linux:syslog	mount/umount or file copy logs
File AccessDC0055	auditd:SYSCALL	open,read

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MountPoint	Organization-specific share mount paths may vary (/mnt/share1, /srv/data etc.)
UID	May need to scope to service accounts or user ID patterns specific to enterprise policy.

AN1147 · macOS

Detection of file access from mounted SMB shares followed by copy or exfil commands from Terminal or script interpreter processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Drive AccessDC0054	fs:fsusage	open/read/mount operations
File AccessDC0055	macos:unifiedlog	filesystem and process events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProcessPath	Script interpreters may vary (e.g., zsh, bash, python, osascript).
SharePath	Network drive mount points may differ across enterprises.

1 analytic

Server Message Block (SMB) is used by Windows to allow for file, pipe, and printer sharing over port 445/tcp. It allows for enumerating, and reading from and writing to file shares for a remote computer. Although it is heavily used by Windows servers for legitimate purposes and by users for file and printer sharing, many adversaries also use SMB to achieve Lateral Movement. Looking at this activity more closely to obtain an adequate sense of situational awareness may make it possible to detect adversaries moving between hosts in a way that deviates from normal activity. Because SMB traffic is heavy in many environments, this analytic may be difficult to turn into something that can be used to quickly detect an APT. In some cases, it may make more sense to run this analytic in a forensic fashion. Looking through and filtering its output after an intrusion has been discovered may be helpful in identifying the scope of compromise.

TypeSituational AwarenessCoverageModerateSubmitted2013

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-IPCTA	IPC Traffic Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	message	dest_port
flow	message	proto_info

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Although there may be more native ways to detect detailed SMB events on the host, they can be extracted out of network traffic. With the right protocol decoders, port 445 traffic can be filtered and even the file path (relative to the share) can be retrieved.

flow = search Flow:Message
smb_events = filter flow where (dest_port == "445" and protocol == "smb")
smb_events.file_name = smb_events.proto_info.file_name
output smb_write

Tests2Executorscmd 1 · PowerShell 1Need elevation2 of 2Have prerequisites2Have cleanup2Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Copy a sensitive File over Administrative share with copy

windows

cmd

Required

Yes

Copy from sensitive File from the c$ of another LAN computer with copy cmd https://twitter.com/SBousseaden/status/1211636381086339073

Input arguments

Name	Type	Default	Description
remote	string	127.0.0.1	Remote server name
local_file	string	Easter_egg.password	Local name
share_file	path	Windows\temp\Easter_Bunny.password	Remote Path to the file

Attack command

copy \\#{remote}\C$\#{share_file} %TEMP%\#{local_file}

Cleanup command

del \\#{remote}\C$\#{share_file}
del %TEMP%\#{local_file}

Prerequisite

Administrative share must exist on #{remote}

Check

if (Test-Path "\\#{remote}\C$") {exit 0} else {exit 1}

Satisfy

Write-Host 'Please Enable "C$" share on #{remote}'

Prerequisite

"\\#{remote}\C$\#{share_file}" must exist on #{remote}

Check

if (Test-Path "\\#{remote}\C$\#{share_file}") {exit 0} else {exit 1}

Satisfy

Out-File -FilePath "\\#{remote}\C$\#{share_file}"

GUID291ed975-237a-4174-93d9-d1760acddeba

Copy a sensitive File over Administrative share with Powershell

windows

PowerShell

Required

Yes

Copy from sensitive File from the c$ of another LAN computer with powershell https://twitter.com/SBousseaden/status/1211636381086339073

Input arguments

Name	Type	Default	Description
remote	string	127.0.0.1	Remote server name
local_file	string	Easter_egg.password	Local name
share_file	path	Windows\temp\Easter_Bunny.password	Remote Path to the file

Attack command

copy-item -Path "\\#{remote}\C$\#{share_file}" -Destination "$Env:TEMP\#{local_file}"

Cleanup command

Remove-Item -Path "\\#{remote}\C$\#{share_file}"
Remove-Item -Path "$Env:TEMP\#{local_file}"

Prerequisite

Administrative share must exist on #{remote}

Check

if (Test-Path "\\#{remote}\C$") {exit 0} else {exit 1}

Satisfy

Write-Host 'Please Enable "C$" share on #{remote}'

Prerequisite

"\\#{remote}\C$\#{share_file}" must exist on #{remote}

Check

if (Test-Path "\\#{remote}\C$\#{share_file}") {exit 0} else {exit 1}

Satisfy

Out-File -FilePath "\\#{remote}\C$\#{share_file}"

GUIDcd79c6ba-a617-4a59-9eda-25af78222a4f

Tests from Atomic Red Team (MIT licence) · technique definition

Data from Network Shared Drive detections T1039

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs