Forensia CTI Core

About

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. Net can be used to query a remote system for available shared drives using the <code>net view \\\\remotesystem</code> command. It can also be used to query shared drives on the local system using <code>net share</code>. For macOS, the <code>sharing -l</code> command lists all shared points used for smb services.

Platforms: Linux, macOS, WindowsMITRE ATT&CK ↗

Used by actors

16 known groups

G0006 APT1 G0035 Dragonfly G0050 APT32 G0054 Sowbug G0081 Tropic Trooper G0082 APT38 G0087 APT39 G0096 APT41 G0102 Wizard Spider G0105 DarkVishnya G0114 Chimera G0131 Tonto Team G1016 FIN13 G1032 INC Ransom G1043 BlackByte G1051 Medusa Group

Software

57 malware/tools implement this

PlugXNetCobalt StrikeOSInfoPupyMURKYTOPKwampirsKoadicZebrocyInvisiMoleTrickBotEmpireOlympic DestroyerEmotetShimRatRamsayIcedIDCrackMapExecBazarBitPaymerContiStuxnetBad RabbitClopWastedLockerDEATHRANSOMHELLOKITTYFIVEHANDSCubaBabukAvaddonQakBotDiavolClamblingQuietSieveWhisperGateSILENTTRINITYFlagproAvosLockerBlackCatRoyalKOPILUWAKBADHATCHSardonicAkiraINC RansomwareLunarWebDUSTTRAPLatrodectusBlackByte RansomwareBlackByte 2.0 RansomwareLockBit 2.0LockBit 3.0RansomHubQilinMedusa RansomwareEmbargo

Corpus indicators tagged with this technique

147 indicators in the corpus carry T1135.

Indicator	Type	Family	Sev	Src
cve-2021-27076	cve	—	85	1
ece33e4b7e2d26eeca8ad9db4439f9801a7a77e332611116156738b1b0316046	sha256	ransomware	80	1
3d00e34594dbaba266f301ca37246e06	hash	—	80	2
a1c3520282c81afabdefa4834b96563edf95c3c7	hash	—	80	2
f8965fdce668692c3785afa3559159f9a18287bc0d53abb21902895a8ecf221b	sha256	ransomware	80	2
5abe477517f51d81061d2e69a9adebdcda80d36667d0afabe103fda4802d33db	sha256	ransomware	80	2
c46bac27b5ca151afabd22c5546f78ae2ae3a20d	hash	—	80	2
4c71357de3c0b12094693ca6eff94cad	hash	—	80	2
39bd9c888d3e8110c127ba60cc727d2538bf7da2	hash	ransomware	80	1
99911fce9e0d697c99421b81e8fe2a04	hash	—	80	2
efc71bd23572eec985a6d1bbf61308fd	hash	—	80	2
4200b46a93c6ab059e2b34ce200c4a5b	hash	ransomware	80	2
3ddd90b99ee7ac3ec39e1d22b67c257d273a0970	hash	—	80	2
f694401d8e80bb0f672b1b30fd7b153a	hash	—	80	2
9ddae47ff968343a8c32a5344060257fdc08e2a7bdb9a227c8b3a584ee3c9f1e	sha256	ransomware	80	2
111e8abb4b8592172d597926f47f018c	hash	—	80	2
42bcc743c71a9ea083c1c750a398110582796762	hash	ransomware	80	2
6a5f9bd0e4a0c385b98cc7b528be53a95ff9c4ccffa8c1f65448ab792a46186c	sha256	—	80	1
cb747c0134f99d5033bac6e966864e2435a2a94244ca8e3f614f4992df93ff10	sha256	ransomware	80	2
5af1dae21425dda8311a2044209c308525135e1733eeff5dd20649946c6e054c	sha256	ransomware	80	2
738d4398e7d11427051093ba8a6f37e51470795c	hash	—	80	2
7b6e094d98eb3f695e5856db4d8d22e11898cec9	hash	—	80	2
2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98	sha256	phishing	80	1
f1551d3e5d144eef4e70a29dd3dc52fb22459d1f	hash	—	80	2
38353f95fff270f4e3a9d7add8c64666020dd668ce66e15969a736ec48cadc59	sha256	phishing	80	1
4253dd1a4c0867b0be7732f75b2f630cebfb7fed94270e15fb3b12ae40546d01	sha256	phishing	80	1
479ae5fd7274439ddfa27bc03298ebfdfc5ff17f6412acccf74d4dbd90d94218	sha256	phishing	80	1
874bcb1c3d050a5b5b333a2198f504fcb27927c2abdd43b07440188a380c52d5	sha256	phishing	80	1
9eaa577c8ba71646928c1c34c3145536b0498f65f26060a6ba00744bcef57644	sha256	phishing	80	1
141b2190f51397dbd0dfde0e3904b264c91b6f81febc823ff0c33da980b69944	sha256	ransomware	80	1

Showing the top 30 by severity of 147.