Shared folders hold the files people actually use: finance sheets, source drops, backups, scans of contracts. That is why an intruder who has landed on one machine often asks the network what is shared. T1135, Network Share Discovery, belongs to the discovery tactic and applies to Linux, macOS and Windows.
MITRE says adversaries look for folders and drives shared on remote systems for two reasons. One is to find sources of information to gather later as part of collection. The other is to find systems of interest for lateral movement.
How attackers use it
On Windows, file sharing runs over SMB. MITRE names the built-in Net utility for this. The command net view \\remotesystem queries a remote system for its shares, and net share lists shares on the local system. On macOS, the command sharing -l lists all share points used for SMB services.
None of this needs special tools, which is the problem. The page lists a long set of groups and malware that run share discovery, including ransomware families, and a post-exploitation tool, CrackMapExec.
The enumeration itself is quiet. What stands out is scale: one machine asking many hosts for their shares in a short time.
How to detect it
MITRE's behavior chain differs by platform.
- Windows. A process or script enumerates shares by command line (
net view,net share, PowerShellGet-SmbShareor WMI) or through OS APIs (NetShareEnum, or thesrvsvc.NetShareEnumAllRPC call). This is followed by bursts of outbound SMB or RPC connections on ports 445 and 139, to theIPC$share and thesrvsvcpipe, across many hosts within a short window. File listing or copy operations may follow. - Linux. Command line tools or scripts enumerate SMB shares on many internal hosts, such as
smbclient -L,smbmap,rpcclientornmblookup. You see matching SMB connections in Zeek or flow data. - macOS. Native tools such as
sharing -l,smbutil viewandmount_smbfs, or scripts, run across many hosts, followed by outbound SMB connections in packet filter or Zeek logs.
The two sources reinforce each other. Process creation logs (Security 4688 with command line, Sysmon event ID 1) tell you who ran the command. Network flow data tells you how many hosts were asked. If you audit file share access on file servers, Windows events 5140 (a network share object was accessed) and 5145 (a share object was checked for access) show who touched which share.
A simple analytic: count distinct destination hosts on port 445 per source per ten minutes. Most clients talk to a few servers. A scanner talks to dozens.
How to reduce the risk
MITRE lists one mitigation, in operating system configuration: enable the Windows Group Policy setting "Do Not Allow Anonymous Enumeration of SAM Accounts and Shares". This limits who can enumerate network shares without credentials.
Beyond that, the real exposure is what each share contains and who can read it. Practical steps that follow from the technique:
- Inventory shares on every file server and workstation. Remove the ones nobody owns.
- Remove broad groups such as "Everyone" or "Domain Users" from shares that hold sensitive material.
- Segment so that workstations cannot reach each other's SMB ports. Clients rarely need to share files peer to peer.
- Alert on one host fanning out SMB connections to many peers.
Check your own environment
Windows, read-only:
net share
Get-SmbShare
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RestrictAnonymous
The first two list local shares. The third shows the anonymous restriction value that the Group Policy setting above controls.
On a Samba file server:
testparm -s
This prints the effective Samba configuration, including the shares it exports.
On macOS:
sharing -l
Make a one-page list of every share you find, its owner, and who can read it. The gaps in that list are your findings.
Try it yourself
Knowing what exists on the network comes first. This demo walks through asset discovery.
Click through it at your own pace, or open it full screen.
Quick check
Which two commands does MITRE name for listing shares with Net?
net view \\remotesystem for a remote host and net share for the local system.
What is a good network signal for share discovery?
One source connecting on SMB ports 445 and 139 to many internal hosts within a short window.
What does the Group Policy setting MITRE names control?
Whether anonymous users can enumerate SAM accounts and shares. Disallowing it limits who can list shares.
Sources
- MITRE ATT&CK, T1135 Network Share Discovery
