Detect Data from Network Shared Drive in Splunk
Adversaries may search network shares on compromised systems to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to exfiltration. Threat actors including APT28, RedCurl, Gamaredon Group, menuPass, Chimera, and BRONZE BUTLER have leveraged this technique using tools such as net use, Robocopy, xcopy, and custom malware to enumerate and bulk-copy documents, configuration files, and credentials from accessible SMB shares.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1039 Data from Network Shared Drive
- Canonical reference
- https://attack.mitre.org/techniques/T1039/
SPL Detection Query
| union
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where match(TargetFilename, "^\\\\\\\\[^\\\\]+\\\\")
| where match(lower(TargetFilename), "\.(doc|docx|xls|xlsx|pdf|ppt|pptx|txt|csv|rtf|db|sql|kdbx|pfx|key|pem|conf|config|ini|bak|eml|msg|pst)$")
| eval SignalType="BulkNetworkShareWrite"
| eval ShareHost=mvindex(split(TargetFilename, "\\"), 2)
| stats count as FileCount, dc(ShareHost) as UniqueShares, values(TargetFilename) as SampleFiles, earliest(_time) as Earliest, latest(_time) as Latest by host, User, Image, CommandLine, SignalType
| where FileCount >= 25
| eval Severity=if(FileCount >= 100, "High", "Medium") ]
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where (match(lower(Image), "net(1)?\.exe$") AND match(CommandLine, "(use|view)") AND match(CommandLine, "\\\\\\\\[a-zA-Z0-9]"))
OR (match(lower(Image), "(robocopy|xcopy|forfiles)\.exe$") AND match(CommandLine, "\\\\\\\\[a-zA-Z0-9]"))
OR ((match(lower(Image), "(powershell|pwsh)\.exe$")) AND match(CommandLine, "\\\\\\\\[a-zA-Z0-9]") AND match(lower(CommandLine), "(get-childitem|copy-item|get-item|gci|cp )"))
| eval SignalType=case(
match(lower(Image), "net(1)?\.exe$"), "NetworkShareMounting",
match(lower(Image), "(robocopy|xcopy|forfiles)\.exe$"), "BulkCopyFromShare",
match(lower(Image), "(powershell|pwsh)\.exe$"), "PowerShellShareCollection",
true(), "NetworkShareToolUsage")
| eval Severity=case(
match(lower(Image), "(robocopy|xcopy|forfiles)\.exe$"), "High",
match(lower(Image), "(powershell|pwsh)\.exe$"), "High",
true(), "Medium")
| eval FileCount=0, UniqueShares=0, SampleFiles=""
| table _time as Earliest, host, User, Image, CommandLine, ParentImage, ParentCommandLine, SignalType, Severity, FileCount, UniqueShares, SampleFiles ]
| rename host as DeviceName, User as AccountName, Image as ProcessImage, CommandLine as ProcessCommandLine
| sort - EarliestTwo-branch detection for T1039 using Sysmon telemetry. Branch 1 uses Event ID 11 (File Create) to identify bulk creation of sensitive document types (25+ files) in paths matching UNC format (\\server\share\), aggregated per process within the search window. Branch 2 uses Event ID 1 (Process Create) to catch net.exe share mounting, Robocopy/xcopy bulk copy tools, and PowerShell Get-ChildItem/Copy-Item operations targeting UNC paths. Both branches tag a SignalType for analyst triage and assign severity based on the tool or volume involved. Adjust the FileCount threshold (default: 25) by baselining your environment's normal share write activity.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Backup agents writing to network share destinations during scheduled backup windows — Sysmon EID 11 will fire at high volume from the backup agent process
- DLP/classification tools scanning network shares — generates sustained EID 11 bursts from the scanning service executable
- Legitimate Robocopy/xcopy jobs for server migration or DR — verify against change management records and expected service account usage
- SharePoint or OneDrive sync clients synchronizing large file sets to UNC-mounted paths
- Software distribution points (SCCM) caching packages to network share locations
- Developers or build pipelines copying build artifacts to file share paths using xcopy or robocopy
Other platforms for T1039
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Map and Enumerate Network Share with net use
Expected signal: Sysmon Event ID 1: net.exe process with CommandLine 'net use Z: \\\\localhost\\C$ /persistent:no'. Sysmon Event ID 3: SMB connection to 127.0.0.1:445. Security Event 4648 if alternate credentials used. Security Event 5140 (network share accessed) on the target if Object Access auditing is enabled.
- Test 2Bulk Document Collection via Robocopy from Network Share
Expected signal: Sysmon Event ID 1: robocopy.exe with CommandLine containing '\\\\localhost' and '/S'. Sysmon Event ID 11: Multiple file creation events in %TEMP%\df00tech-stage with .dll extension. Sysmon Event ID 3: SMB connection to 127.0.0.1:445 from robocopy.exe process.
- Test 3PowerShell Recursive Document Harvest from Network Share
Expected signal: Sysmon Event ID 1: powershell.exe with CommandLine containing 'Get-ChildItem', '\\\\localhost', 'Copy-Item'. Sysmon Event ID 11: Multiple file creation events in %TEMP%\df00tech-ps-stage. Sysmon Event ID 3: SMB connection to 127.0.0.1:445. PowerShell ScriptBlock Logging Event ID 4104 will capture the full deobfuscated script showing UNC access pattern.
- Test 4Forfiles-based Targeted Extension Harvest from Share
Expected signal: Sysmon Event ID 1: forfiles.exe with CommandLine containing '\\\\localhost' and '/S'. Sysmon Event ID 1 (child): cmd.exe spawned by forfiles.exe with copy command. Sysmon Event ID 11: File creation events in %TEMP%\df00tech-forfiles-stage.
References (12)
- https://attack.mitre.org/techniques/T1039/
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf
- https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
- https://www.group-ib.com/resources/research/red-curl/
- https://www.eset.com/int/about/newsroom/press-releases/research/eset-research-uncovers-gamaredon-groups-malicious-activities-in-ukraine/
- https://www.symantec.com/blogs/threat-intelligence/sowbug-targets-government-agencies
- https://www.f-secure.com/documents/996508/1030745/cosmicduke_whitepaper.pdf
- https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOF.PDF
- https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-devicefileevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1039/T1039.md
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/robocopy
Unlock Pro Content
Get the full detection package for T1039 including response playbook, investigation guide, and atomic red team tests.