Threat intelligence / Technique

Network Share Discovery

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\remotesystem command. It can also be used to query shared drives on the local system using net share . For macOS, the sharing -l command lists all shared points used for smb services.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. (Citation: Wikipedia Shared Resource) (Citation: TechNet Shared Folder) [Net](https://attack.mitre.org/software/S0039) can be used to query a remote system for available shared drives using the net view \\\\remotesystem command. It can also be used to query shared drives on the local system using net share . For macOS, the sharing -l command lists all shared points used for smb services.

79 recorded

Relationships

mapped-to

from Identify Shared Files/Directories on System

Technique

mitigates

from Operating System Configuration

Mitigation

uses

from Akira

Malware

uses

from APT1

Group

uses

from APT32

Group

uses

from APT38

Group

uses

from APT39

Group

uses

from APT41

Group

uses

Malware

uses

from AvosLocker

Malware

uses

from Babuk

Malware

uses

Malware

uses

from Bad Rabbit

Malware

uses

from Bazar

Malware

uses

Malware

uses

Group

uses

from BlackByte 2.0 Ransomware

Malware

uses

from BlackByte Ransomware

Malware

uses

Malware

uses

from C0015

Campaign

uses

Group

uses

Malware

uses

from Clop

Malware

uses

from Cobalt Strike

Malware

uses

from Conti

Malware

uses

from CrackMapExec

Tool

uses

from Cuba

Malware

uses

from DarkVishnya

Group

uses

from DEATHRANSOM

Malware

uses

Malware

uses

Group

uses

Malware

uses

Malware

uses

Malware

uses

Tool

uses

from FIN13

Group

uses

Malware

uses

Malware

uses

from HELLOKITTY

Malware

uses

Malware

uses

from INC Ransom

Group

uses

from INC Ransomware

Malware

uses

from InvisiMole

Malware

uses

Tool

uses

Malware

uses

Malware

uses

from Latrodectus

Malware

uses

from Leviathan Australian Intrusions

Campaign

uses

from LockBit 2.0

Malware

uses

from LockBit 3.0

Malware

uses

Malware

uses

from Medusa Group

Group

uses

from Medusa Ransomware

Malware

uses

Malware

uses

from Net

Tool

uses

from Olympic Destroyer

Malware

uses

from Operation CuckooBees

Campaign

uses

from Operation Wocao

Campaign

uses

Malware

uses

from PlugX

Malware

uses

from Pupy

Tool

uses

Malware

uses

from Qilin

Malware

uses

from QuietSieve

Malware

uses

Malware

uses

Malware

uses

from Royal

Malware

uses

Malware

uses

Malware

uses

from SILENTTRINITY

Tool

uses

Group

uses

Malware

uses

from Tonto Team

Group

uses

Malware

uses

from Tropic Trooper

Group

uses

from WastedLocker

Malware

uses

from WhisperGate

Malware

uses

from Wizard Spider

Group

uses

Malware

3 external

References

mitre-attack

T1135

TechNet Shared Folder

https://technet.microsoft.com/library/cc770880.aspx

Wikipedia Shared Resource

https://en.wikipedia.org/wiki/Shared_resource