T1039

Data from Network Shared Drive

Collection Last updated:

Adversaries may search network shares on compromised systems to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to exfiltration. Threat actors including APT28, RedCurl, Gamaredon Group, menuPass, Chimera, and BRONZE BUTLER have leveraged this technique using tools such as net use, Robocopy, xcopy, and custom malware to enumerate and bulk-copy documents, configuration files, and credentials from accessible SMB shares.

What is T1039 Data from Network Shared Drive?

Data from Network Shared Drive (T1039) maps to the Collection tactic — the adversary is trying to gather data of interest to their goal in MITRE ATT&CK.

This page provides production-ready detection logic for Data from Network Shared Drive, covering the data sources and telemetry it touches: File: File Access, Network Share: Network Share Access, Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Collection
Technique
T1039 Data from Network Shared Drive
Canonical reference
https://attack.mitre.org/techniques/T1039/
Microsoft Sentinel / Defender
kusto 
let SuspiciousExtensions = dynamic(["doc", "docx", "xls", "xlsx", "pdf", "ppt", "pptx", "txt", "csv", "rtf", "db", "sql", "kdbx", "pfx", "key", "pem", "conf", "config", "ini", "bak", "eml", "msg", "ost", "pst"]);
let BulkAccessThreshold = 25;
let LookbackWindow = 2h;
// Signal 1: Bulk file reads/copies from UNC network paths in a short window
let BulkShareReads = DeviceFileEvents
| where Timestamp > ago(LookbackWindow)
| where ActionType in ("FileRead", "FileCopied", "FileCreated")
| where FolderPath startswith @"\\\\"
| where FileExtension in~ (SuspiciousExtensions)
| summarize
    FileCount = count(),
    UniqueShares = dcount(tostring(split(FolderPath, "\\")[2])),
    FileTypes = make_set(FileExtension, 20),
    SampleFiles = make_set(FileName, 10),
    Earliest = min(Timestamp),
    Latest = max(Timestamp)
    by DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileCount >= BulkAccessThreshold
| extend SignalType = "BulkNetworkShareRead", Severity = iff(FileCount >= 100, "High", "Medium");
// Signal 2: net use / net view commands mapping or enumerating shares
let NetUseCommands = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has "use" or ProcessCommandLine has "view"
| where ProcessCommandLine matches regex @"\\\\.+"
| extend SignalType = "NetworkShareMounting", Severity = "Medium"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, SignalType, Severity;
// Signal 3: Robocopy / xcopy / forfiles targeting UNC paths for bulk data collection
let BulkCopyTools = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where FileName in~ ("robocopy.exe", "xcopy.exe", "forfiles.exe")
| where ProcessCommandLine matches regex @"\\\\"
| extend SignalType = "BulkCopyFromShare", Severity = "High"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, SignalType, Severity;
// Signal 4: PowerShell bulk enumeration and copy from network paths
let PowerShellShareCollection = DeviceProcessEvents
| where Timestamp > ago(LookbackWindow)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (@"\\\\", "Get-ChildItem", "Copy-Item", "Get-Item")
       and ProcessCommandLine has_any (@"\\\\", "UNC", "-Path", "-Recurse")
| where ProcessCommandLine matches regex @"\\\\.+"
| extend SignalType = "PowerShellShareCollection", Severity = "High"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, SignalType, Severity;
// Combine all signals
BulkShareReads
| project Timestamp = Earliest, DeviceName, AccountName,
          FileName = InitiatingProcessFileName,
          ProcessCommandLine = InitiatingProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          SignalType, Severity, FileCount, UniqueShares,
          FileTypes = tostring(FileTypes), SampleFiles = tostring(SampleFiles)
| union (NetUseCommands | extend FileCount = 0, UniqueShares = 0, FileTypes = "", SampleFiles = "")
| union (BulkCopyTools | extend FileCount = 0, UniqueShares = 0, FileTypes = "", SampleFiles = "")
| union (PowerShellShareCollection | extend FileCount = 0, UniqueShares = 0, FileTypes = "", SampleFiles = "")
| sort by Timestamp desc

Multi-signal detection covering four distinct collection patterns for T1039. Signal 1 identifies bulk file reads/copies from UNC paths (\\server\share) in DeviceFileEvents where a single process accesses 25+ documents (configurable) matching sensitive extensions within 2 hours. Signal 2 catches net.exe/net1.exe invocations mapping or viewing network shares. Signal 3 detects Robocopy, xcopy, and forfiles targeting UNC paths — a menuPass TTP. Signal 4 flags PowerShell Get-ChildItem or Copy-Item operations against network paths, commonly used by RedCurl and Gamaredon. The BulkAccessThreshold variable (default: 25) should be tuned to your environment's baseline share access volume.

high severity medium confidence

Data Sources

File: File Access Network Share: Network Share Access Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceFileEvents DeviceProcessEvents

False Positives

  • Backup agents (Veeam, Commvault, Windows Server Backup) performing scheduled backups from network shares — typically run as a service account during off-hours windows
  • DLP or data classification tools (Varonis, Spirion, Microsoft Purview) scanning network shares during inventory runs — generates high FileCount against many share paths
  • IT administrators using Robocopy or xcopy for legitimate data migration, server decommission, or disaster recovery operations with pre-approved change tickets
  • File synchronization clients (OneDrive, SharePoint sync, Dropbox Business) that mount SMB shares and perform bulk reads for sync operations
  • Antivirus or EDR agents performing full scan of network-accessible paths — parent process will be a security product executable
  • Software deployment tools (SCCM, Intune) accessing distribution point shares to cache or distribute software packages

Sigma rule & cross-platform mapping

The detection logic for Data from Network Shared Drive (T1039) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1039 Sigma rules on detection.fyi

Platform-specific guides for T1039

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-16 Research depth: deep
References (7)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Map and Enumerate Network Share with net use

    Expected signal: Sysmon Event ID 1: net.exe process with CommandLine 'net use Z: \\\\localhost\\C$ /persistent:no'. Sysmon Event ID 3: SMB connection to 127.0.0.1:445. Security Event 4648 if alternate credentials used. Security Event 5140 (network share accessed) on the target if Object Access auditing is enabled.

  2. Test 2Bulk Document Collection via Robocopy from Network Share

    Expected signal: Sysmon Event ID 1: robocopy.exe with CommandLine containing '\\\\localhost' and '/S'. Sysmon Event ID 11: Multiple file creation events in %TEMP%\df00tech-stage with .dll extension. Sysmon Event ID 3: SMB connection to 127.0.0.1:445 from robocopy.exe process.

  3. Test 3PowerShell Recursive Document Harvest from Network Share

    Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Get-ChildItem', '\\\\localhost', 'Copy-Item'. Sysmon Event ID 11: Multiple file creation events in %TEMP%\df00tech-ps-stage. Sysmon Event ID 3: SMB connection to 127.0.0.1:445. PowerShell ScriptBlock Logging Event ID 4104 will capture the full deobfuscated script showing UNC access pattern.

  4. Test 4Forfiles-based Targeted Extension Harvest from Share

    Expected signal: Sysmon Event ID 1: forfiles.exe with CommandLine containing '\\\\localhost' and '/S'. Sysmon Event ID 1 (child): cmd.exe spawned by forfiles.exe with copy command. Sysmon Event ID 11: File creation events in %TEMP%\df00tech-forfiles-stage.

Response Playbook

Triage

  1. Identify the process initiating the share access — is it a known backup agent (veeam, arcserve, wbengine.exe), a DLP scanner, or an unusual binary? Cross-reference the process hash against threat intel.
  2. Determine the source account — is it a service account, domain admin, regular user, or computer account ($)? Check if this account normally accesses this share by reviewing baseline DeviceFileEvents for the past 30 days.
  3. Map the target shares — what is the share hostname and path? Is it a file server, domain controller SYSVOL/NETLOGON, backup server, or a departmental share containing sensitive data (HR, Finance, Legal)?
  4. Check file types accessed — a mix of .docx, .pdf, .xlsx, and .kdbx (KeePass) or .pfx (certificates) is a strong indicator of targeted document collection versus a backup job that would access all file types uniformly.
  5. Review the timeline — bulk access occurring during business hours from a legitimate user workstation is different from access at 2am from a server that doesn't normally access that share. Correlate with logon events (Security Event 4624) on the source host.
  6. Look for staging artifacts — after share collection, adversaries often compress files before exfiltration. Check DeviceFileEvents for archive creation (.zip, .7z, .rar) immediately following the share access burst on the same device.
  7. Check for lateral movement context — was there a recent successful login (4624 Type 3 - Network) to the device accessing the share? Did the account recently access multiple hosts? Query DeviceLogonEvents for the account across all devices in the last 24h.

Containment

  1. If active collection is confirmed (high file count, sensitive data, non-backup process): isolate the source endpoint immediately via EDR network isolation to prevent exfiltration of already-collected data.
  2. Disable the account performing the collection in Active Directory (Set-ADUser -Enabled $false) and revoke all active Kerberos tickets: klist purge on affected systems, or use Reset-ComputerMachinePassword if a computer account is involved.
  3. Remove the mapped network drive if the share was mounted via net use: net use \\SERVER\SHARE /delete. Check HKCU\Network registry key on the source host for persistent drive mappings.
  4. If Robocopy or xcopy was used and a destination staging directory is identified, preserve it as evidence before quarantining — it may contain the collected file set needed for incident scope assessment.
  5. Block the source IP at the file server firewall level if the compromised host cannot be immediately isolated. Verify with `Get-SmbOpenFile` on the file server to see active SMB sessions: `Get-SmbOpenFile | Where-Object {$_.ClientComputerName -eq 'COMPROMISED_HOST'} | Close-SmbOpenFile`.
  6. If the share server is a domain controller (SYSVOL/NETLOGON collection), escalate to a domain-level incident immediately — this indicates possible Active Directory reconnaissance or GPO abuse.

Evidence Collection

  1. SMB Audit Logs on the file server — enable Object Access auditing (Security Event 5145: Network share object was accessed) if not already active. This provides granular per-file access records with source IP.
  2. Sysmon Event ID 11 (File Create) on the source host — captures every file written to the staging directory if the adversary is copying collected files locally.
  3. Sysmon Event ID 3 (Network Connection) from the source process — shows the destination IPs for any subsequent exfiltration from the staging directory.
  4. Security Event 4688 (Process Creation with command line) or Sysmon Event ID 1 on the source host — captures the full command line of net.exe, robocopy, xcopy, or PowerShell used for collection.
  5. Security Event 4624/4625 on the file server — determines how the adversary authenticated to access the share (NTLM vs Kerberos, pass-the-hash indicators).
  6. MFT ($MFT) forensic artifact from the source host — timestamps of file creation in staging directories provide precise collection timeline.
  7. VSS (Volume Shadow Copies) on the source host — may contain earlier versions of the collected files or the staging directory if it was cleaned up.
  8. Windows Prefetch files on the source host — %WINDIR%\Prefetch\ROBOCOPY.EXE-*.pf or NET.EXE-*.pf contain execution timestamps and accessed file paths.
  9. Network captures (if available) — SMB traffic to/from the file server during the collection window. Look for sustained reads from share paths with large cumulative data volumes.

Escalation Criteria

  • ! Files accessed include credential stores: .kdbx (KeePass), .pfx/.p12 (certificates with private keys), SAM/SECURITY/SYSTEM hives, or password manager databases.
  • ! Target share is SYSVOL, NETLOGON, or a share on a domain controller — indicates AD reconnaissance or GPO policy theft.
  • ! File count exceeds 500 documents in a single session, particularly if file types include HR, Finance, or Legal directory naming patterns.
  • ! Collection followed immediately by archive creation (.zip, .7z, .rar) on the same host — two-stage collection+staging pattern strongly indicates imminent exfiltration.
  • ! The source account is a service account, machine account, or administrator account that has no business need to access the specific share.
  • ! Multiple source hosts accessing the same sensitive share simultaneously within a short window — indicates automated malware (BADNEWS, Ramsay, CosmicDuke pattern) rather than a single compromised user.
  • ! Network connections from the source host to external IPs or unusual internal hosts immediately following the collection burst — possible active exfiltration in progress.

Investigation Guide

Forensic Artifacts

  • > Registry: HKCU\Network — persistent mapped drive entries (DriveLetter, RemotePath, UserName) for any net use /persistent:yes connections
  • > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 — record of all UNC paths ever accessed from this user profile
  • > File System: %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations — LNK files and JumpList entries showing recently accessed network share paths
  • > File System: %WINDIR%\Prefetch\NET.EXE-*.pf, ROBOCOPY.EXE-*.pf, XCOPY.EXE-*.pf — execution timestamps and paths of collection tools
  • > Windows Event Log: Security Event 5140 (Network share was accessed) and 5145 (Network share object check) on the FILE SERVER — requires Object Access audit policy enabled
  • > Windows Event Log: Security Event 4648 (Explicit credential logon) on source host — indicates RunAs or alternate credential use to access shares
  • > Windows Event Log: Security Event 4776 on DC — NTLM authentication to file server; flat password hash for PTH detection
  • > SMB: `Get-SmbSession` and `Get-SmbOpenFile` output captured from the file server at time of incident — shows active connections
  • > Network: NetFlow/pcap showing sustained SMB (TCP 445) reads from source host to file server with large byte counts
  • > MFT: $MFT timestamps on staging directories (Created, Modified) correlate precisely with collection timeline

Tuning Guidance

The primary false positive source for T1039 detection is legitimate backup and DLP tooling. Start by baselining the top 10 processes generating UNC file access events in your environment — backup agents (veeam.backup.agent.exe, arcagent.exe, wbengine.exe), EDR agents, and DLP scanners will dominate. Create exclusions by process path hash (not just name — attackers masquerade as backup tools) combined with the specific service account. For the bulk file count threshold, query your baseline 30-day P95 of file accesses per process per hour against UNC paths — set your alert threshold at 2-3x that value. For net.exe hunting, exclude the specific command lines used by your IT tooling (SCCM, Intune) by allowlisting the exact parent process + command line combination, never just the command line substring. For Robocopy detections, cross-reference against your IT change management calendar — migrations and DR tests will generate true-positive-looking telemetry. Consider enriching alerts with the target share's data classification label (e.g., from a CASB or DLP system) so that access to high-sensitivity shares (HR, Finance, Executive) is auto-escalated regardless of file count.

Hunting Queries

Hunt for accounts or hosts touching an unusually large number of distinct network share servers within a 1-hour window. Legitimate users typically access 1-3 shares consistently; touching 5+ distinct share servers indicates breadth-first reconnaissance and collection (characteristic of APT28 and Chimera campaigns mapping the entire environment).

Hunting — KQL
kql 
// Hunt for accounts accessing an unusually large number of DISTINCT network share servers
// (breadth-first collection pattern — adversaries mapping an entire org's shares)
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath startswith @"\\\\"
| extend ShareServer = tostring(split(FolderPath, "\\")[2])
| where ShareServer != ""
| summarize
    UniqueSharesTouched = dcount(ShareServer),
    TotalFileOps = count(),
    ShareList = make_set(ShareServer, 20),
    FileTypes = make_set(FileExtension, 15)
    by AccountName, DeviceName, bin(Timestamp, 1h)
| where UniqueSharesTouched >= 5
| sort by UniqueSharesTouched desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "^\\\\\\\\[^\\\\]+\\\\")
| eval ShareServer=mvindex(split(TargetFilename, "\\"), 2)
| where isnotnull(ShareServer) AND ShareServer!=""
| bin _time span=1h
| stats dc(ShareServer) as UniqueSharesTouched, count as TotalFileOps, values(ShareServer) as ShareList by _time, host, User
| where UniqueSharesTouched >= 5
| sort - UniqueSharesTouched

Hunt for net.exe share operations spawned by unusual parent processes. Legitimate share mapping comes from cmd.exe, PowerShell, or explorer.exe. Malware families like Ramsay, BADNEWS, and CosmicDuke spawn net.exe directly from their own process or inject into trusted hosts — a non-standard parent is a high-fidelity indicator of malicious collection automation.

Hunting — KQL
kql 
// Hunt for unusual parent processes launching net.exe for share operations
// Malware often spawns net.exe from non-standard parents (not cmd.exe, explorer.exe)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has_any ("use", "view", "share")
| where InitiatingProcessFileName !in~ (
    "cmd.exe", "powershell.exe", "pwsh.exe",
    "explorer.exe", "services.exe", "svchost.exe"
  )
| summarize Count=count(), UniqueDevices=dcount(DeviceName), CommandLines=make_set(ProcessCommandLine, 10)
    by InitiatingProcessFileName, InitiatingProcessCommandLine
| where Count >= 1
| sort by UniqueDevices desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (Image="*\\net.exe" OR Image="*\\net1.exe")
    (CommandLine="*use*" OR CommandLine="*view*" OR CommandLine="*share*")
    NOT (ParentImage="*\\cmd.exe" OR ParentImage="*\\powershell.exe" OR ParentImage="*\\pwsh.exe" OR ParentImage="*\\explorer.exe" OR ParentImage="*\\services.exe" OR ParentImage="*\\svchost.exe")
| stats count as Count, dc(host) as UniqueDevices, values(CommandLine) as CommandLines by ParentImage, ParentCommandLine
| sort - UniqueDevices

Hunt for the two-stage collection-then-staging kill chain: network share file access followed by archive creation on the same host within 30 minutes. This sequence (collect → compress) is the signature pattern for pre-exfiltration staging observed in Egregor, BRONZE BUTLER, and Sowbug operations before data was exfiltrated to C2 infrastructure.

Hunting — KQL
kql 
// Hunt for the collection → staging → archive kill chain on a single host
// Sequence: UNC file access THEN archive creation within 30 minutes
let CollectionEvents = DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileRead", "FileCopied", "FileCreated")
| where FolderPath startswith @"\\\\"
| summarize CollectionTime=min(Timestamp), FileCount=count() by DeviceName, AccountName
| where FileCount >= 10;
let ArchiveEvents = DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileCreated")
| where FileExtension in~ ("zip", "7z", "rar", "gz", "tar", "cab")
| project ArchiveTime=Timestamp, DeviceName, AccountName, ArchivePath=FolderPath, ArchiveName=FileName;
CollectionEvents
| join kind=inner ArchiveEvents on DeviceName, AccountName
| where ArchiveTime between (CollectionTime .. (CollectionTime + 30m))
| project DeviceName, AccountName, CollectionTime, ArchiveTime, FileCount, ArchivePath, ArchiveName, TimeDeltaMinutes=datetime_diff('minute', ArchiveTime, CollectionTime)
| sort by CollectionTime desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval IsNetworkFile=if(match(TargetFilename, "^\\\\\\\\[^\\\\]+\\\\"), 1, 0)
| eval IsArchive=if(match(lower(TargetFilename), "\.(zip|7z|rar|gz|tar|cab)$"), 1, 0)
| where IsNetworkFile=1 OR IsArchive=1
| bin _time span=30m
| stats sum(IsNetworkFile) as NetworkFileOps, sum(IsArchive) as ArchiveCreations, values(TargetFilename) as SamplePaths by _time, host, User
| where NetworkFileOps >= 10 AND ArchiveCreations >= 1
| sort - _time

Atomic Red Team Tests

Test 1 Map and Enumerate Network Share with net use
windows

Maps a network share using net use and then lists its contents with dir — the baseline pattern used by menuPass, Fox Kitten, and manual intrusion operators to discover accessible shares before targeted collection. Uses localhost (C$) as a safe test target requiring no external infrastructure.

Command

powershell 
net use Z: \\localhost\C$ /persistent:no
dir Z:\
dir Z:\Windows\System32 /s /b | findstr ".dll" | head -20
net use Z: /delete

Cleanup

powershell 
net use Z: /delete 2>nul

Expected Telemetry

Sysmon Event ID 1: net.exe process with CommandLine 'net use Z: \\\\localhost\\C$ /persistent:no'. Sysmon Event ID 3: SMB connection to 127.0.0.1:445. Security Event 4648 if alternate credentials used. Security Event 5140 (network share accessed) on the target if Object Access auditing is enabled.

Expected Detection

KQL Signal 2 (NetUseCommands) fires on net.exe + 'use' + UNC path pattern. SPL Branch 2 fires on EventCode=1 with net.exe, 'use', and UNC path match. The subsequent dir command does not independently trigger but the share mapping event is captured.

Test 2 Bulk Document Collection via Robocopy from Network Share
windows

Uses Robocopy with the /S (recursive) and /XO (exclude older) flags to copy all Office documents from a network share to a local staging directory. This exactly matches the menuPass TTP documented in PWC Cloud Hopper — adversaries used Robocopy to systematically harvest intellectual property from file servers across victim organizations.

Command

powershell 
mkdir %TEMP%\df00tech-stage 2>nul
robocopy \\localhost\C$\Windows\System32 %TEMP%\df00tech-stage *.dll /S /XO /R:1 /W:1 /LOG:%TEMP%\robocopy_test.log
type %TEMP%\robocopy_test.log | findstr "Files :"
echo [TEST COMPLETE] Robocopy collection simulated

Cleanup

powershell 
rmdir /s /q %TEMP%\df00tech-stage 2>nul
del %TEMP%\robocopy_test.log 2>nul

Expected Telemetry

Sysmon Event ID 1: robocopy.exe with CommandLine containing '\\\\localhost' and '/S'. Sysmon Event ID 11: Multiple file creation events in %TEMP%\df00tech-stage with .dll extension. Sysmon Event ID 3: SMB connection to 127.0.0.1:445 from robocopy.exe process.

Expected Detection

KQL Signal 3 (BulkCopyTools) fires on robocopy.exe + UNC path regex match. SPL Branch 2 fires on EventCode=1 + robocopy.exe + UNC path. If file count exceeds 25, Signal 1 / Branch 1 also fires on the Sysmon EID 11 events in the staging directory.

Test 3 PowerShell Recursive Document Harvest from Network Share
windows

Simulates the Gamaredon Group and RedCurl collection pattern: using PowerShell Get-ChildItem with -Recurse to enumerate a network share and Copy-Item to exfiltrate matching documents to a local staging directory. This automated approach collects all documents matching specific extensions without operator interaction.

Command

powershell 
powershell.exe -NoProfile -Command "
$stagingDir = Join-Path $env:TEMP 'df00tech-ps-stage';
New-Item -ItemType Directory -Force -Path $stagingDir | Out-Null;
$share = '\\\\localhost\\C$\\Windows\\System32';
$extensions = @('*.dll', '*.exe', '*.ini');
foreach ($ext in $extensions) {
    Get-ChildItem -Path $share -Filter $ext -Recurse -ErrorAction SilentlyContinue |
    Select-Object -First 10 |
    ForEach-Object { Copy-Item $_.FullName -Destination $stagingDir -Force -ErrorAction SilentlyContinue }
};
$collected = (Get-ChildItem $stagingDir).Count;
Write-Host \"[TEST] Collected $collected files to $stagingDir\"
"

Cleanup

powershell 
powershell.exe -Command "Remove-Item -Recurse -Force (Join-Path $env:TEMP 'df00tech-ps-stage') -ErrorAction SilentlyContinue"

Expected Telemetry

Sysmon Event ID 1: powershell.exe with CommandLine containing 'Get-ChildItem', '\\\\localhost', 'Copy-Item'. Sysmon Event ID 11: Multiple file creation events in %TEMP%\df00tech-ps-stage. Sysmon Event ID 3: SMB connection to 127.0.0.1:445. PowerShell ScriptBlock Logging Event ID 4104 will capture the full deobfuscated script showing UNC access pattern.

Expected Detection

KQL Signal 4 (PowerShellShareCollection) fires on powershell.exe + UNC path + Get-ChildItem/Copy-Item. SPL Branch 2 fires on EventCode=1 + powershell.exe + UNC regex + Get-ChildItem. KQL Signal 1 / SPL Branch 1 may also fire if file count reaches BulkAccessThreshold.

Test 4 Forfiles-based Targeted Extension Harvest from Share
windows

Uses forfiles.exe — a built-in Windows tool — to collect files matching sensitive extensions from a network path. This LOLBin-based approach is used to evade detections focused only on Robocopy/xcopy. The /S flag enables recursive traversal and /C allows arbitrary command execution per matching file.

Command

powershell 
mkdir %TEMP%\df00tech-forfiles-stage 2>nul
forfiles /P \\localhost\C$\Windows\System32 /S /M *.dll /C "cmd /c copy @path %TEMP%\df00tech-forfiles-stage\" 2>nul
dir %TEMP%\df00tech-forfiles-stage | findstr "File(s)"
echo [TEST COMPLETE] Forfiles share harvest simulated

Cleanup

powershell 
rmdir /s /q %TEMP%\df00tech-forfiles-stage 2>nul

Expected Telemetry

Sysmon Event ID 1: forfiles.exe with CommandLine containing '\\\\localhost' and '/S'. Sysmon Event ID 1 (child): cmd.exe spawned by forfiles.exe with copy command. Sysmon Event ID 11: File creation events in %TEMP%\df00tech-forfiles-stage.

Expected Detection

KQL Signal 3 (BulkCopyTools) fires on forfiles.exe + UNC path match. SPL Branch 2 fires on EventCode=1 with forfiles.exe + UNC regex. The spawned cmd.exe child processes are also captured in process creation telemetry, revealing the copy command targeting the staging directory.

Related Detections

Tactic Hub

TA0009Collection

Related Techniques

T1078Valid AccountsT1021.002SMB/Windows Admin SharesT1083File and Directory DiscoveryT1135Network Share DiscoveryT1560Archive Collected DataT1041Exfiltration Over C2 ChannelT1048Exfiltration Over Alternative ProtocolT1550.002Pass the HashT1025Data from Removable MediaT1005Data from Local System

Same Tactic: Collection

Popular Detections