Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-4.8 | Uninstall or Disable Unnecessary Services on Enterprise Assets and Software | mitigates | T1039 | Data from Network Shared Drive |
Comments
Removing unnecessary file-sharing services and shares reduces the network data repositories available for adversary collection.
References
|
| CIS-3.5 | Securely Dispose of Data | mitigates | T1039 | Data from Network Shared Drive |
Comments
Secure disposal reduces obsolete or unnecessary sensitive data left on shared drives, limiting what an adversary can collect from network shares.
References
|
| CIS-3.11 | Encrypt Sensitive Data At Rest | mitigates | T1039 | Data from Network Shared Drive |
Comments
Encryption protects sensitive shared-drive data against unauthorized disclosure
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.malware.variety.Capture stored data | Capture data stored on system disk | related-to | T1039 | Data from Network Shared Drive | |
| attribute.confidentiality.data_disclosure | Confirmed or potential data disclosure | related-to | T1039 | Data from Network Shared Drive |