tfMITRE ATT&CK technique

Network Share Discovery T1135

Tactic: Discovery
Platforms: Linux, macOS, Windows
Version: 3.2
Created: 14 December 2017
Last modified: 24 October 2025
Contributor: Praetorian

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 11%

Threat groups89th percentile · 89% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 10%

Campaigns90th percentile · 90% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 7%

Tools & malware93rd percentile · 93% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 16%

Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.

Network Share Discovery MITRE reference T1135

Top 11%of all ATT&CK techniques for number of groups

16 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Medusa GroupG1051 ↗

Has identified network shares using cmd.exe /c net share.1

created 2025-10-151 reference

BlackByteG1043 ↗

Enumerated network shares on victim devices.1

created 2024-12-161 referenceaka Hecamede

INC RansomG1032 ↗

Has used Internet Explorer to view folders on other systems.1

created 2024-06-061 referenceaka GOLD IONIC

FIN13G1016 ↗

Has executed net view commands for enumeration of open shares on compromised machines.1 2

created 2023-07-272 referencesaka Elephant Beetle

Tonto TeamG0131 ↗

Has used tools such as NBTscan to enumerate network shares.1

created 2021-05-051 referenceaka Earth Akhlut

ChimeraG0114 ↗

Has used net share and net view to identify network shares of interest.1

created 2020-08-241 reference

All 16 groups for this technique · 6 newest in this preview

4 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Leviathan Australian IntrusionsC0049 ↗

Leviathan scanned and enumerated remote network shares in victim environments during Leviathan Australian Intrusions.1

2022

C0015C0015 ↗

During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.1

2021

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, the threat actors used the net share command as part of their advanced reconnaissance.1

2019–2022

Operation WocaoC0014 ↗

During Operation Wocao, threat actors discovered network disks mounted to the system using netstat.1

2017–2019

All 4 campaigns for this technique

Offense vs defense T1135

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 4Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 8

first rule: 2017 Q4 · 4 of 4 campaigns plotted

Network Share Discovery detection strategy DET0182

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS

Enterprise

3 platforms

AN0513 · Windows

Process or script enumerates network shares via CLI (net view/net share, PowerShell Get-SmbShare/WMI) or OS APIs (NetShareEnum/ srvsvc.NetShareEnumAll RPC) → bursts of outbound SMB/RPC connections (445/139, \\host\IPC$ / srvsvc) to many hosts inside a short window → optional follow-on file listing or copy operations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	etw:Microsoft-Windows-RPC	rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Named Pipe MetadataDC0048	WinEventLog:Sysmon	EventCode=17
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BurstHostThreshold	Minimum number of unique destination hosts over SMB within TimeWindow to treat as scanning (e.g., ≥5).
TimeWindow	Correlation window between the discovery process start and SMB fan-out (default 10m).
AllowedDiscoveryAccounts	Service/admin accounts legitimately running inventory scripts.
PipeNameAllowList	Pipes (e.g., \PIPE\spoolss) normally accessed by management agents; exclude from alerts.

AN0514 · Linux

CLI tools (smbclient -L, smbmap, rpcclient, nmblookup) or custom scripts enumerate SMB shares on many internal hosts → corresponding SMB connections (445/139) captured by Zeek/Netflow within a short window.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	NSM:Flow	smb_command: TreeConnectAndX to \\*\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares
Process CreationDC0032	auditd:SYSCALL	execve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb
Network Connection CreationDC0082	NSM:Flow	connection: TCP connections to ports 139/445 to multiple hosts

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BurstHostThreshold	Minimum unique hosts to flag (e.g., ≥5).
TimeWindow	Correlation window between tool exec and SMB fan-out (default 10m).
ApprovedInventoryHosts	IPs of vulnerability scanners or config mgmt systems.

AN0515 · macOS

Use of native/mac tools (sharing -l, smbutil view, mount_smbfs) or scripts to enumerate SMB shares across many hosts, followed by outbound SMB connections observed in PF/Zeek logs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC: Process execution of "sharing -l", "smbutil view", "mount_smbfs"
Command ExecutionDC0064	macos:unifiedlog	Command line contains smbutil view //, mount_smbfs //
Network Traffic FlowDC0078	NSM:Firewall	Outbound connections to 139/445 to multiple destinations
Network Connection CreationDC0082	NSM:Flow	connection: SMB connections to multiple internal hosts

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BurstHostThreshold	Minimum unique SMB destinations (e.g., ≥3–5 in smaller mac fleets).
TimeWindow	Correlation window between exec and SMB connections (default 10m).
AllowedMgmtTools	Jamf/IT scripts legitimately running smbutil/mount_smbfs.

Tests12ExecutorsPowerShell 6 · cmd 3 · sh 2 · bash 1Need elevation2 of 12Have prerequisites6Have cleanup2Platformsmacos, linux, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Network Share Discovery

macos

—

Network Share Discovery

Input arguments

Name	Type	Default	Description
computer_name	string	computer1	Computer name to find a mount on.

Attack command

df -aH
smbutil view -g //#{computer_name}
showmount #{computer_name}

GUID7bf55b34-47f4-44a5-a49b-40b4c895c64d

Network Share Discovery - linux

linux

bash

Required

—

Network Share Discovery using smbstatus

Input arguments

Name	Type	Default	Description
package_checker	string	(rpm -q samba &>/dev/null) \|\| (dpkg -s samba \| grep -q installed)	Package checking command. Debian - dpkg -s samba
package_installer	string	(which yum && yum -y install epel-release samba)\|\|(which apt-get && DEBIAN_FRONTEND=noninteractive apt-get install -y samba)	Package installer command. Debian - apt install samba

Attack command

smbstatus --shares

Prerequisite

Package with smbstatus (samba) must exist on device

Check

if #{package_checker} > /dev/null; then exit 0; else exit 1; fi

Satisfy

#{package_installer}

GUID2e05cdf5-3f36-4a08-802a-e87943337735

Network Share Discovery - FreeBSD

linux

Required

—

Network Share Discovery using smbstatus

Input arguments

Name	Type	Default	Description
package_checker	string	(pkg info -x samba &>/dev/null)	Package checking command. pkg info -x samba
package_installer	string	(which pkg && pkg install -y samba413)	Package installer command. pkg install -y samba413

Attack command

smbstatus --shares

Prerequisite

Package with smbstatus (samba) must exist on device

Check

if #{package_checker} > /dev/null; then exit 0; else exit 1; fi

Satisfy

#{package_installer}

GUID7a1f1900-c173-498a-91f1-efc939afe4c1

Network Share Discovery command prompt

windows

cmd

—

Network Share Discovery utilizing the command prompt. The computer name variable may need to be modified to point to a different host Upon execution available network shares will be displayed in the powershell session

Input arguments

Name	Type	Default	Description
computer_name	string	localhost	Computer name to find a mount on.

Attack command

net view \\#{computer_name}

GUID4039dcdf-757c-4dd7-9ec9-8c73d9ec2769

Network Share Discovery PowerShell

windows

PowerShell

—

View available share drives

windows

cmd

—

Share Discovery with PowerView

windows

PowerShell

—

PowerView ShareFinder

windows

PowerShell

—

PowerView is a PowerShell tool to gain network situational awareness on Windows domains. ShareFinder finds (non-standard) shares on machines in the domain.

Input arguments

Name	Type	Default	Description
parameters	string	-CheckShareAccess	ShareFinder parameter

Attack command

Import-Module "PathToAtomicsFolder\..\ExternalPayloads\PowerView.ps1"
Invoke-ShareFinder #{parameters}

Prerequisite

Invoke-ShareFinder module must exist in %TEMP% directory

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PowerView.ps1") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://raw.githubusercontent.com/darkoperator/Veil-PowerView/8784e33f17ee7543ba2f45e27dc5f08ea3a1b856/PowerView/powerview.ps1" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PowerView.ps1"

GUIDb2ef01ba-53e6-4b32-98e4-c9cd2e435652

WinPwn - shareenumeration

windows

PowerShell

—

Network Share Discovery via dir command

windows

cmd

—

Network Share Discovery utilizing the dir command prompt. The computer ip variable may need to be modified to point to a different host ip Upon execution available network shares will be displayed in the commandline session

Input arguments

Name	Type	Default	Description
computer_ip	string	127.0.0.1	Computer IP to find a mount on.

Attack command

dir \\#{computer_ip}\c$
dir \\#{computer_ip}\admin$
dir \\#{computer_ip}\IPC$

GUIDe061671d-c73a-40e8-8358-905470878429

Enumerate All Network Shares with SharpShares

windows

PowerShell

—

Yes

SharpShares is a command line tool that can be integrated with Cobalt Strike's execute-assembly module, allowing for the enumeration of network shares. This technique has been utilized by various ransomware groups, including BianLian. Reference

Input arguments

Name	Type	Default	Description
sharp_path	String	PathToAtomicsFolder\..\ExternalPayloads\SharpShares.exe	Path to the SharpShares executable
output_path	String	$env:temp\T1135SharpSharesOutput.txt	File to output enumeration results to

Attack command

cmd /c '#{sharp_path}' /ldap:all | out-file -filepath "#{output_path}"

Cleanup command

remove-item "#{output_path}" -force -erroraction silentlycontinue

Prerequisite

The SharpShares executable must exist on disk

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\SharpShares.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/mitchmoser/SharpShares/releases/download/v2.4/SharpShares.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\SharpShares.exe"

GUIDc0ae7a1a-63eb-4eca-8112-5e269589f7f0

Enumerate All Network Shares with Snaffler

windows

PowerShell

—

Yes

Snaffler is an open-source tool that has been used by various threat groups, including Scattered Spider/Muddled Libra, to enumerate accessible shares and credential-containing files within a domain. Reference

Input arguments

Name	Type	Default	Description
output_path	String	$env:temp\T1135SnafflerOutput.txt	File to output enumeration results to
snaffler_path	String	PathToAtomicsFolder\..\ExternalPayloads\Snaffler.exe	Path to the Snaffler executable

Attack command

invoke-expression 'cmd /c start powershell -command { cmd /c "#{snaffler_path}" -a -o "#{output_path}" }; start-sleep 90; stop-process -name "snaffler"'

Cleanup command

remove-item "#{output_path}" -force -erroraction silentlycontinue

Prerequisite

The Snaffler executable must exist on disk

Check

if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\Snaffler.exe") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/SnaffCon/Snaffler/releases/download/1.0.150/Snaffler.exe" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\Snaffler.exe"

GUID030eed35-91c5-4aca-b117-93cf346a8c2d

Tests from Atomic Red Team (MIT licence) · technique definition

Network Share Discovery detections T1135

16 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 16%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs