t1135-network-share-discovery

name	T1135_network-share-discovery
description	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of in...
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1135","discovery","linux","macos","windows"]
technique_id	T1135
tactic	discovery
all_tactics	["discovery"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1135
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1135 Network Share Discovery

High-Level Description

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

File sharing over a Windows network occurs over the SMB protocol. Net can be used to query a remote system for available shared drives using the net view \\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for smb services.

Kill Chain Phase

• Discovery (TA0007)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Network Share Discovery technique is applicable to target environment
• Check Linux systems for indicators of Network Share Discovery
• Check macOS systems for indicators of Network Share Discovery
• Check Windows systems for indicators of Network Share Discovery
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Network Share Discovery

Network Share Discovery

Supported Platforms: macos

df -aH
smbutil view -g //#{computer_name}
showmount #{computer_name}

Atomic Test 2: Network Share Discovery - linux

Network Share Discovery using smbstatus

Supported Platforms: linux Elevation Required: Yes

smbstatus --shares

Dependencies:

• Package with smbstatus (samba) must exist on device