Detect Data from Network Shared Drive in Elastic Security
Adversaries may search network shares on compromised systems to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to exfiltration. Threat actors including APT28, RedCurl, Gamaredon Group, menuPass, Chimera, and BRONZE BUTLER have leveraged this technique using tools such as net use, Robocopy, xcopy, and custom malware to enumerate and bulk-copy documents, configuration files, and credentials from accessible SMB shares.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1039 Data from Network Shared Drive
- Canonical reference
- https://attack.mitre.org/techniques/T1039/
Elastic Detection Query
sequence by host.name, user.name with maxspan=2h
[any where event.category == "file" and event.action in ("creation", "change") and
file.path : "\\\\*" and
file.extension in~ ("doc", "docx", "xls", "xlsx", "pdf", "ppt", "pptx", "txt", "csv", "rtf", "db", "sql", "kdbx", "pfx", "key", "pem", "conf", "config", "ini", "bak", "eml", "msg", "ost", "pst")]
[any where event.category == "process" and
(
(process.name in~ ("net.exe", "net1.exe") and process.command_line : ("* use *", "* view *") and process.command_line : "*\\\\*") or
(process.name in~ ("robocopy.exe", "xcopy.exe", "forfiles.exe") and process.command_line : "*\\\\*") or
(process.name in~ ("powershell.exe", "pwsh.exe") and process.command_line : "*\\\\*" and
process.command_line : ("*Get-ChildItem*", "*Copy-Item*", "*Get-Item*", "*-Recurse*"))
)
]
// Standalone bulk file collection rule (pipe separately in SIEM workflow):
// from logs-endpoint.events.file-*
// | where event.category == "file"
// | where file.path like "\\\\*"
// | where file.extension in ("doc","docx","xls","xlsx","pdf","ppt","pptx","txt","csv","rtf","db","sql","kdbx","pfx","key","pem","conf","config","ini","bak","eml","msg","ost","pst")
// | stats count(*) as file_count, count_distinct(file.path) as unique_paths by host.name, user.name, process.name
// | where file_count >= 25Detects data collection from network shared drives by correlating bulk UNC-path file creation/access events with share enumeration or bulk copy tool execution. Covers net use/view, robocopy, xcopy, forfiles, and PowerShell Get-ChildItem/Copy-Item targeting SMB shares within a 2-hour window — matching MITRE ATT&CK T1039 tactics observed from APT28, RedCurl, and Chimera.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate backup software (e.g., Veeam, Backup Exec agents) performing scheduled file copies from network shares to local staging directories
- IT administrators using robocopy or xcopy for sanctioned data migrations between file servers or department shares
- Software deployment tools (SCCM, PDQ Deploy) using UNC paths to stage installation packages across the environment
Other platforms for T1039
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Map and Enumerate Network Share with net use
Expected signal: Sysmon Event ID 1: net.exe process with CommandLine 'net use Z: \\\\localhost\\C$ /persistent:no'. Sysmon Event ID 3: SMB connection to 127.0.0.1:445. Security Event 4648 if alternate credentials used. Security Event 5140 (network share accessed) on the target if Object Access auditing is enabled.
- Test 2Bulk Document Collection via Robocopy from Network Share
Expected signal: Sysmon Event ID 1: robocopy.exe with CommandLine containing '\\\\localhost' and '/S'. Sysmon Event ID 11: Multiple file creation events in %TEMP%\df00tech-stage with .dll extension. Sysmon Event ID 3: SMB connection to 127.0.0.1:445 from robocopy.exe process.
- Test 3PowerShell Recursive Document Harvest from Network Share
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Get-ChildItem', '\\\\localhost', 'Copy-Item'. Sysmon Event ID 11: Multiple file creation events in %TEMP%\df00tech-ps-stage. Sysmon Event ID 3: SMB connection to 127.0.0.1:445. PowerShell ScriptBlock Logging Event ID 4104 will capture the full deobfuscated script showing UNC access pattern.
- Test 4Forfiles-based Targeted Extension Harvest from Share
Expected signal: Sysmon Event ID 1: forfiles.exe with CommandLine containing '\\\\localhost' and '/S'. Sysmon Event ID 1 (child): cmd.exe spawned by forfiles.exe with copy command. Sysmon Event ID 11: File creation events in %TEMP%\df00tech-forfiles-stage.
References (12)
- https://attack.mitre.org/techniques/T1039/
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf
- https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
- https://www.group-ib.com/resources/research/red-curl/
- https://www.eset.com/int/about/newsroom/press-releases/research/eset-research-uncovers-gamaredon-groups-malicious-activities-in-ukraine/
- https://www.symantec.com/blogs/threat-intelligence/sowbug-targets-government-agencies
- https://www.f-secure.com/documents/996508/1030745/cosmicduke_whitepaper.pdf
- https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOF.PDF
- https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1039/T1039.md
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/robocopy
Unlock Pro Content
Get the full detection package for T1039 including response playbook, investigation guide, and atomic red team tests.