Data from Network Shared Drive
- ID
- T1039
- Tactics
- TA0009 Collection
- Platforms
- Linux, macOS, Windows
- Data sources
- Network Share Access, File Creation, File Access, Drive Access
- Source
- attack.mitre.org
- MITRE last modified
- 3 Sep 2026
Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.[1][2]
Detection
- DET0410 Detection Strategy for Data from Network Shared Drive
Data components: Network Share Access, File Creation, File Access, Drive Access
Groups (9)
- G0007 APT28
- G0045 menuPass
- G0047 Gamaredon Group
- G0054 Sowbug
- G0060 BRONZE BUTLER
- G0114 Chimera
- G0117 Fox Kitten
- G1039 RedCurl
- G1059 NIMBUS MANTICORE