tfMITRE ATT&CK technique

Network Share Discovery T1135

Tactic: Discovery
Platforms: Linux, macOS, Windows
Version: 3.2
Created: 14 December 2017
Last modified: 24 October 2025
Contributor: Praetorian

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 11%

Threat groups89th percentile · 88% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 10%

Campaigns90th percentile · 88% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 7%

Tools & malware93rd percentile · 93% of ATT&CK techniques have fewer tools implementing them.

Detection rulesTop 16%

Detection rules84th percentile · 83% of ATT&CK techniques have fewer detection rules written.

Offense vs defense T1135

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 4Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 8

Data component	Name	Channel
OS API ExecutionDC0021	etw:Microsoft-Windows-RPC	rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Named Pipe MetadataDC0048	WinEventLog:Sysmon	EventCode=17
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Data component

Name

Channel

OS API ExecutionDC0021

etw:Microsoft-Windows-RPC

rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Named Pipe MetadataDC0048

WinEventLog:Sysmon

EventCode=17

Command ExecutionDC0064

WinEventLog:PowerShell

EventCode=4103, 4104, 4105, 4106

Network Connection CreationDC0082

WinEventLog:Sysmon

EventCode=3, 22

Field	What you tune
BurstHostThreshold	Minimum number of unique destination hosts over SMB within TimeWindow to treat as scanning (e.g., ≥5).
TimeWindow	Correlation window between the discovery process start and SMB fan-out (default 10m).
AllowedDiscoveryAccounts	Service/admin accounts legitimately running inventory scripts.
PipeNameAllowList	Pipes (e.g., \PIPE\spoolss) normally accessed by management agents; exclude from alerts.

Field

What you tune

BurstHostThreshold

Minimum number of unique destination hosts over SMB within TimeWindow to treat as scanning (e.g., ≥5).

TimeWindow

Correlation window between the discovery process start and SMB fan-out (default 10m).

AllowedDiscoveryAccounts

Service/admin accounts legitimately running inventory scripts.

PipeNameAllowList

Pipes (e.g., \PIPE\spoolss) normally accessed by management agents; exclude from alerts.

Data component	Name	Channel
OS API ExecutionDC0021	NSM:Flow	smb_command: TreeConnectAndX to \\*\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares
Process CreationDC0032	auditd:SYSCALL	execve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb
Network Connection CreationDC0082	NSM:Flow	connection: TCP connections to ports 139/445 to multiple hosts

Field	What you tune
BurstHostThreshold	Minimum unique hosts to flag (e.g., ≥5).
TimeWindow	Correlation window between tool exec and SMB fan-out (default 10m).
ApprovedInventoryHosts	IPs of vulnerability scanners or config mgmt systems.

Data component	Name	Channel
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC: Process execution of "sharing -l", "smbutil view", "mount_smbfs"
Command ExecutionDC0064	macos:unifiedlog	Command line contains smbutil view //, mount_smbfs //
Network Traffic FlowDC0078	NSM:Firewall	Outbound connections to 139/445 to multiple destinations
Network Connection CreationDC0082	NSM:Flow	connection: SMB connections to multiple internal hosts

Field	What you tune
BurstHostThreshold	Minimum unique SMB destinations (e.g., ≥3–5 in smaller mac fleets).
TimeWindow	Correlation window between exec and SMB connections (default 10m).
AllowedMgmtTools	Jamf/IT scripts legitimately running smbutil/mount_smbfs.

Offense vs defense T1135

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 4Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 8

Data component	Name	Channel
OS API ExecutionDC0021	etw:Microsoft-Windows-RPC	rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Named Pipe MetadataDC0048	WinEventLog:Sysmon	EventCode=17
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Data component

Name

Channel

OS API ExecutionDC0021

etw:Microsoft-Windows-RPC

rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes

Process CreationDC0032

WinEventLog:Security

EventCode=4688

Named Pipe MetadataDC0048

WinEventLog:Sysmon

EventCode=17

Command ExecutionDC0064

WinEventLog:PowerShell

EventCode=4103, 4104, 4105, 4106

Network Connection CreationDC0082

WinEventLog:Sysmon

EventCode=3, 22

Field	What you tune
BurstHostThreshold	Minimum number of unique destination hosts over SMB within TimeWindow to treat as scanning (e.g., ≥5).
TimeWindow	Correlation window between the discovery process start and SMB fan-out (default 10m).
AllowedDiscoveryAccounts	Service/admin accounts legitimately running inventory scripts.
PipeNameAllowList	Pipes (e.g., \PIPE\spoolss) normally accessed by management agents; exclude from alerts.

Field

What you tune

BurstHostThreshold

Minimum number of unique destination hosts over SMB within TimeWindow to treat as scanning (e.g., ≥5).

TimeWindow

Correlation window between the discovery process start and SMB fan-out (default 10m).

AllowedDiscoveryAccounts

Service/admin accounts legitimately running inventory scripts.

PipeNameAllowList

Pipes (e.g., \PIPE\spoolss) normally accessed by management agents; exclude from alerts.

Data component	Name	Channel
OS API ExecutionDC0021	NSM:Flow	smb_command: TreeConnectAndX to \\*\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares
Process CreationDC0032	auditd:SYSCALL	execve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb
Network Connection CreationDC0082	NSM:Flow	connection: TCP connections to ports 139/445 to multiple hosts

Field	What you tune
BurstHostThreshold	Minimum unique hosts to flag (e.g., ≥5).
TimeWindow	Correlation window between tool exec and SMB fan-out (default 10m).
ApprovedInventoryHosts	IPs of vulnerability scanners or config mgmt systems.

Data component	Name	Channel
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC: Process execution of "sharing -l", "smbutil view", "mount_smbfs"
Command ExecutionDC0064	macos:unifiedlog	Command line contains smbutil view //, mount_smbfs //
Network Traffic FlowDC0078	NSM:Firewall	Outbound connections to 139/445 to multiple destinations
Network Connection CreationDC0082	NSM:Flow	connection: SMB connections to multiple internal hosts

Field	What you tune
BurstHostThreshold	Minimum unique SMB destinations (e.g., ≥3–5 in smaller mac fleets).
TimeWindow	Correlation window between exec and SMB connections (default 10m).
AllowedMgmtTools	Jamf/IT scripts legitimately running smbutil/mount_smbfs.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-10-24	2026-05-13	9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Network Share Discovery	-	high	@Kostastsale	2022-12-22	2024-08-23	c3d76afc-93df-461e-8e67-9b2bad3f2ac4
	Adversaries may look for details about the network configuration and settings of systems they access (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Domain Trust Discovery Discovery Network Share Discovery Discovery Permission Groups Discovery Domain Groups Discovery System Network Connections Discovery Discovery System Owner/User Discovery	-	high	frack113	2021-12-10	2023-02-14	b2317cfa-4a47-4ead-b3ff-297438c0bc2d
Splunk	Identifies execution of network share enumeration commands (smbutil, showmount) that can be leveraged by adversaries to discover accessible SMB and NFS resources, supporting internal reconnaissance and potential lateral movement.	Anomaly	stable	process_creation	-	Osquery	Discovery Network Share Discovery	-	medium	Raven Tait, Splunk	2026-04-14	2026-10-02	a5f5fe52-8e50-4fb0-ad1b-780be6c0d857
	Detects execution of "Net.EXE".	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Discovery Network Share Discovery Discovery Password Policy Discovery Discovery Permission Groups Discovery Local Groups Domain Groups Lateral Movement Remote Services SMB/Windows Admin Shares Discovery Remote System Discovery Discovery System Network Connections Discovery Discovery System Service Discovery	-	low	Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)	2019-01-16	2022-07-11	183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
Splunk	The following analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. (...)	Hunting	stable	network_connection	windows	WinEventLog Security	Discovery Network Share Discovery	-	medium	Teoderick Contreras, Splunk	2023-05-23	2026-10-02	dc1457d0-1d9b-422e-b5a7-db46c184d9aa
	Detects potential Dridex acitvity via specific process patterns	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Discovery Network Share Discovery Privilege Escalation, Stealth Process Injection Discovery System Owner/User Discovery	-	critical	Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-01-10	2023-02-03	e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e
	Detects the use of Advanced IP Scanner. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy	2020-05-12	2023-02-07	bef37fa2-f205-4a7b-b484-0759bfd5f86f
	Detects the use of Advanced Port Scanner.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2021-12-18	2023-02-07	54773c5f-f1cc-4703-9126-2f797d96a69d
	Detects automated lateral movement by Turla group	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	critical	Markus Neis	2017-11-07	2022-10-09	c601f20d-570a-4cde-a7d6-e17f99cb8e7f
Splunk	The following analytic detects a source computer accessing Windows administrative shares (C$, Admin$, IPC$) on 30 or more remote endpoints within a 5-minute window. (...)	Generic	stable	network_connection	windows	WinEventLog Security	Discovery Network Share Discovery	-	medium	Mauricio Velazco, Splunk	2023-03-23	2026-05-13	d92f2d95-05fb-48a7-910f-4d3d61ab8655
Splunk	The following analytic detects the execution of the Invoke-ShareFinder PowerShell cmdlet from PowerView. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Network Share Discovery	-	medium	Mauricio Velazco, Splunk	2023-03-21	2026-10-02	a44c0be1-d7ab-41e4-92fd-aa9af4fe232c
Splunk	The following analytic detects a high volume of Kerberos service ticket requests, specifically more than 30, from a single source within a 5-minute window. (...)	Anomaly	stable	authentication	windows	WinEventLog Security	Discovery Network Share Discovery Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mauricio Velazco, Splunk	2023-03-21	2026-07-05	386ad394-c9a7-4b4f-b66f-586252de20f0
Splunk	The following analytic identifies network share discovery and collection activities performed on Windows systems using the Net command. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Data from Network Shared Drive Discovery Network Share Discovery	-	medium	Dean Luxton	2024-07-11	2026-10-02	e51fbdb0-0be0-474f-92ea-d289f71a695e
Splunk	The following analytic detects a user authenticating with special privileges on 30 or more remote endpoints within a 5-minute window. (...)	Generic	stable	authentication	windows	WinEventLog Security	Discovery Account Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Mauricio Velazco, Splunk	2023-03-23	2026-05-13	4c461f5a-c2cc-4e86-b132-c262fc9edca7

Title

Description

Network Share Discovery T1135

Network Share Discovery T1135

Network Share Discovery MITRE reference T1135

Offense vs defense T1135

Network Share Discovery detection strategy DET0182

Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Network Share Discovery MITRE reference T1135

Offense vs defense T1135

Network Share Discovery detection strategy DET0182

Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Network Share Discovery detections T1135

Network Share Discovery detections T1135