Data from Network Shared Drives (T1039): Detection Guide

Data from Network Shared Drive is ATT&CK T1039. It belongs to the Collection tactic and applies to Linux, macOS and Windows. After an attacker lands on one machine, the file servers and shared folders it can reach become a place to look for something valuable.

How attackers use it

MITRE describes the behavior as searching network shares on compromised computers to find files of interest. Sensitive data can be collected from remote systems through shared network drives, such as a host's shared directory or a network file server, that are reachable from the current system before exfiltration. Interactive command shells may be in use, and common functionality in cmd may be used to gather the information.

Procedure examples show how routine it is. One malware family crawls the victim's mapped drives at start and collects documents with extensions such as .doc, .docx, .pdf, .ppt, .pptx and .txt. Another steals user files from network shared drives with extensions and keywords that match a predefined list. Several groups, and a ransomware campaign, are listed as collecting files from network shares before exfiltration or encryption.

The key point for defenders is that this is ordinary file access. The shape of it is what stands out: breadth, volume and the process doing the reading.

How to detect it

The MITRE analytics describe the same pattern across platforms:

• Windows: file access to network shares, including administrative shares such as C$ and Admin$, followed by unusual read or copy operations by processes that do not normally do that, such as PowerShell or certutil.
• Linux: unusual access or copying of files from mounted network drives such as NFS or CIFS and SMB, by user shells or scripts, followed by a large data transfer.
• macOS: file access from mounted SMB shares followed by copy or exfiltration commands from Terminal or a script interpreter process.

Data to collect: file server access logs with user, source host, file path and volume. On Windows file servers, object access auditing for file shares produces event 5145 for network share object access, and detailed file share auditing records each file touched. Pair it with endpoint process and network logs so you can say which process on which workstation did the reading.

Signals worth alerting on:

• One account or host reading an unusually large number of files across many folders.
• Access in a share the account has never used.
• Reads from administrative shares by a standard user workstation.
• A burst of reads followed by an outbound transfer.

How to reduce the risk

MITRE's page for this technique lists no dedicated mitigations. The following steps come from the behavior it describes. Give shares to groups with a need, not to everyone. Remove stale shares and mapped drives. Keep the most sensitive data on shares that only a small group can reach, with access auditing turned on. Alert on bulk reads by accounts that do not usually do them.

Check your own environment

Windows, list the shares a server exposes and review who can reach each:

Get-SmbShare | Select-Object Name, Path, Description
Get-SmbShareAccess -Name "ShareName"

Replace ShareName with one from the first command. Windows, list the sessions currently connected to the server:

Get-SmbSession | Select-Object ClientComputerName, ClientUserName, NumOpens

Questions to ask for each share: who needs it, who has it today, and would you notice if one account read all of it in an afternoon?

Quick check

Sources

• MITRE ATT&CK T1039: Data from Network Shared Drive