T1135

Network Share Discovery

Discovery Last updated:

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. Net can be used to query a remote system for available shared drives using the net view \\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for SMB services. Adversaries including Conti, BlackByte, Medusa, Latrodectus, QakBot, and Cuba have all leveraged network share discovery as a precursor to lateral movement, ransomware staging, and data collection operations, frequently calling NetShareEnum() directly or through net.exe wrappers.

What is T1135 Network Share Discovery?

Network Share Discovery (T1135) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Network Share Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated medium severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1135 Network Share Discovery
Canonical reference
https://attack.mitre.org/techniques/T1135/
Microsoft Sentinel / Defender
kusto 
// T1135 - Network Share Discovery
// Detects network share enumeration via built-in tools, PowerShell, WMI, and offensive tooling
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    // net.exe / net1.exe - most common method used by Latrodectus, Kwampirs, QakBot
    (FileName in~ ("net.exe", "net1.exe") and
     ProcessCommandLine has_any (" view", " share"))
    // PowerShell share enumeration via SMB cmdlets or WMI Win32_Share
    or (FileName in~ ("powershell.exe", "pwsh.exe") and
        ProcessCommandLine has_any ("Get-SmbShare", "Win32_Share", "NetShareEnum", "net share", "net view"))
    // WMI via wmic.exe querying share class
    or (FileName =~ "wmic.exe" and
        ProcessCommandLine has_any ("share", "Win32_Share"))
    // NBTscan - network recon tool used by Tonto Team
    or FileName =~ "nbtscan.exe"
    // CrackMapExec with SMB/shares flags - used by APT39
    or (ProcessCommandLine has_any ("crackmapexec", "cme ") and
        ProcessCommandLine has_any ("smb", "--shares"))
)
| extend IsRemoteView = (
    FileName in~ ("net.exe", "net1.exe") and
    ProcessCommandLine has " view" and
    (ProcessCommandLine contains @"\\" or ProcessCommandLine has "/all")
)
| extend IsLocalShare = (
    FileName in~ ("net.exe", "net1.exe") and
    ProcessCommandLine has " share" and
    not ProcessCommandLine has_any ("add", "delete", "/delete")
)
| extend IsNetAllDomain = (
    FileName in~ ("net.exe", "net1.exe") and
    ProcessCommandLine has " view" and
    ProcessCommandLine has "/all"
)
| extend IsPowerShellWmi = (
    FileName in~ ("powershell.exe", "pwsh.exe") and
    ProcessCommandLine has_any ("Get-SmbShare", "Win32_Share", "NetShareEnum")
)
| extend IsSuspiciousTool = (
    FileName =~ "nbtscan.exe" or
    (ProcessCommandLine has_any ("crackmapexec", "cme ") and
     ProcessCommandLine has_any ("smb", "--shares"))
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         IsRemoteView, IsLocalShare, IsNetAllDomain, IsPowerShellWmi, IsSuspiciousTool
| sort by Timestamp desc

Detects network share discovery using Microsoft Defender for Endpoint DeviceProcessEvents. Covers the most common enumeration methods: net.exe/net1.exe 'view' and 'share' subcommands (including remote UNC and /all domain-wide variants), PowerShell Get-SmbShare and WMI Win32_Share queries, wmic.exe share enumeration, NBTscan, and CrackMapExec with SMB flags. Boolean extension columns classify the detection method to help analysts quickly triage and prioritize follow-on investigation.

medium severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • IT administrators running net view or net share during legitimate network inventory, troubleshooting, or helpdesk work
  • Backup agents and monitoring tools querying local or remote shares on a scheduled basis (e.g., Veeam, Backup Exec, SolarWinds Network Performance Monitor)
  • Vulnerability scanners and asset management platforms (Nessus, Qualys, Lansweeper) performing scheduled share enumeration as part of network discovery scans
  • SCCM distribution point or DFS replication health checks that enumerate available shares on managed servers
  • Developers or DevOps engineers using PowerShell Get-SmbShare or WMI to configure, validate, or document share permissions

Sigma rule & cross-platform mapping

The detection logic for Network Share Discovery (T1135) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1135 Sigma rules on detection.fyi

Platform-specific guides for T1135

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-18 Research depth: deep
References (8)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Enumerate Local Shares with net share

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe (or net1.exe), CommandLine='net share', ParentImage=cmd.exe or powershell.exe. Security Event ID 4688 if command line auditing is enabled via GPO.

  2. Test 2Enumerate All Domain Network Shares with net view /all

    Expected signal: Sysmon Event ID 1: Process Create with CommandLine='net view /all /domain'. Sysmon Event ID 3: Multiple outbound SMB connections (port 445) to domain controllers and other hosts. Windows Security Event ID 5145 on accessed servers for each share access check. DNS queries for domain host resolution.

  3. Test 3Query Specific Remote Host Shares via UNC Path

    Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'net view \\\\' followed by the resolved hostname. Sysmon Event ID 3: SMB connection to the target host on port 445. Windows Security Event ID 5140 and 5145 on the target host recording the source account and enumerated share names.

  4. Test 4PowerShell WMI Network Share Enumeration via Win32_Share

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Win32_Share'. PowerShell ScriptBlock Log Event ID 4104 with the full WMI query and returned share objects. Module load events (Sysmon Event ID 7) for WMI-related DLLs.

  5. Test 5SMB Share Enumeration via PowerShell Get-SmbShare Cmdlet

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-SmbShare'. PowerShell ScriptBlock Log Event ID 4104 with the full cmdlet invocation and output. Sysmon Event ID 7: Module load for SmbShare module DLLs (Microsoft.SMBServer.*).

Response Playbook

Triage

  1. Identify the user account and device type — is this a standard user endpoint, a server, or a privileged admin host? Net view/net share on a standard user workstation with no open helpdesk ticket is significantly more suspicious than the same command on a dedicated IT admin workstation.
  2. Examine the parent process — was net.exe spawned by cmd.exe launched from a document (winword.exe, excel.exe), a web browser, a scripting engine (wscript.exe, cscript.exe, mshta.exe), or a service? These parent processes indicate initial access or phishing-stage execution. Legitimate admin use typically originates from interactive cmd.exe, PowerShell, or explorer.exe.
  3. Assess the enumeration scope: did the command target a specific host via UNC path (net view \\hostname), enumerate the entire domain (/all or /all /domain), or only query the local system (net share)? Domain-wide enumeration from a standard endpoint is far more indicative of automated malware reconnaissance than a targeted single-host query.
  4. Check the timing — does this occur during normal business hours for the user's timezone, or at night and on weekends? Ransomware pre-staging (Conti, Medusa, BlackByte) frequently performs share enumeration outside business hours to reduce detection likelihood.
  5. Look for a discovery command cluster in the 15 minutes before and after this event: systeminfo.exe, ipconfig.exe, whoami.exe, nltest.exe, net user, net group, tasklist, arp -a. A burst of multiple discovery commands from one host is a strong ransomware or post-exploitation indicator.
  6. Check for subsequent SMB connections — did the device establish new SMB connections (port 445) to previously unseen internal hosts within 10 minutes of the share enumeration? This may indicate immediate lateral movement to discovered shares.

Containment

  1. If share enumeration is immediately followed by new SMB connections to internal hosts or file staging activity, isolate the endpoint via EDR network isolation to prevent lateral spread across discovered share paths.
  2. If a privileged account (service account, domain admin, local admin) is involved, disable the account in Active Directory, force credential reset, and audit all systems that account has accessed in the preceding 48 hours.
  3. Block the identified source host from SMB access (TCP 445) to critical file servers and domain controllers using host-based firewall policy or network segment ACLs while investigation proceeds.
  4. If ransomware indicators are co-present (volume shadow copy deletion via vssadmin, rapid mass file modifications, services being stopped), activate full incident response procedures and consider isolating the affected network segment.
  5. Audit and temporarily tighten access to administrative shares (C$, ADMIN$, IPC$) on critical servers if lateral movement via admin shares is suspected — restrict access to explicitly authorized admin accounts only pending investigation.

Evidence Collection

  1. Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 (requires command line auditing GPO) from the source endpoint, capturing the full net.exe or PowerShell command line with all arguments and parent process context.
  2. Windows Security Log — Event ID 5140 (A network share object was accessed) and Event ID 5145 (A network share object was checked to see whether client can be granted desired access) on target file servers, capturing source IP, source account, share name, and access mask for all enumeration attempts.
  3. Network Connection Events — Sysmon Event ID 3 for outbound SMB connections (TCP 445) from the source host. Correlate connection destinations with shares returned by the enumeration to identify which discovered shares were subsequently accessed.
  4. Prefetch Files — C:\Windows\Prefetch\NET.EXE-*.pf and NET1.EXE-*.pf contain execution timestamps and referenced file paths, providing reliable evidence of when share enumeration occurred even if event logs have been cleared.
  5. PowerShell ScriptBlock Logging (Event ID 4104) — if enumeration used PowerShell, captures the full deobfuscated script including any Get-SmbShare, Win32_Share, or NetShareEnum calls, along with the output objects if collected.
  6. EDR Process Tree — retrieve the full process tree for the suspicious net.exe or PowerShell process, tracing back to the root parent to identify the initial execution vector (document, scheduled task, lateral movement, service).
  7. File System Artifacts — search %TEMP%, %APPDATA%, and user profile directories for any output redirection files (e.g., shares.txt, out.txt) that may contain the enumerated share list staged for exfiltration.
  8. DNS and NetBIOS Logs — review DNS query logs and NetBIOS name resolution for resolution of hostnames corresponding to the UNC paths used in net view commands, which can reveal target selection methodology.

Escalation Criteria

  • ! Share enumeration followed within 10 minutes by new SMB connections (Sysmon Event ID 3, port 445) to previously uncontacted internal hosts — strong indicator of active lateral movement to discovered shares.
  • ! Discovery command cluster: share enumeration co-occurring within 5 minutes with 3 or more other discovery techniques (systeminfo, ipconfig, whoami, net user, tasklist) from the same host — consistent with ransomware or post-exploitation framework automated reconnaissance.
  • ! Presence of offensive tooling (CrackMapExec, NBTscan, Impacket smbclient.py) — these have no legitimate enterprise use and confirm deliberate attacker activity regardless of share enumeration findings.
  • ! Enumeration performed by a service account, machine account, or account that does not normally run interactive commands — indicates credential compromise or living-off-the-land lateral movement using harvested credentials.
  • ! Net view /all or /all /domain executed from a standard user endpoint — domain-wide enumeration from non-admin hosts is not legitimate behavior and indicates active attacker reconnaissance at scale.
  • ! Volume shadow copy deletion (vssadmin delete shadows, wmic shadowcopy delete) observed within 30 minutes of share enumeration — this is a near-definitive ransomware pre-encryption indicator requiring immediate IR escalation.

Investigation Guide

Forensic Artifacts

  • > Windows Security Event Log: Event ID 5140 (Network Share Object Accessed) on target servers — records source IP, account name, share name, and access type for each enumeration probe.
  • > Windows Security Event Log: Event ID 5145 (Network Share Object Access Check) on target servers — fires on each access check during enumeration even without successful file access, capturing granular enumeration telemetry.
  • > Windows Security Event Log: Event ID 4688 (Process Creation with command line auditing) or Sysmon Event ID 1 on the source host — net.exe command line with 'view' or 'share' subcommand and all arguments.
  • > Prefetch: C:\Windows\Prefetch\NET.EXE-*.pf and NET1.EXE-*.pf — execution timestamps, run count, and loaded DLL references confirming share enumeration activity.
  • > File System: %TEMP%, %USERPROFILE%\Desktop, and %APPDATA% — search for text files containing share lists (e.g., output redirected via 'net view > shares.txt'), which indicate deliberate collection of enumeration output.
  • > Registry: HKCU\Network — mapped network drives that may have been established by the attacker after discovering shares, persisting through logoffs.
  • > PowerShell History: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — may contain Get-SmbShare, WMI Win32_Share queries, or net.exe wrappers from interactive sessions.
  • > SMB PCAP / NetFlow: Network captures showing NTLMSSP authentication followed by NetShareEnum (SRVSVC pipe) or TreeConnect requests to target hosts, capturing the enumeration at the protocol level independent of endpoint telemetry.

Tuning Guidance

The primary false positive challenge for T1135 is legitimate IT administration — net view and net share are built-in Windows tools regularly used by helpdesk and sysadmin teams. Start by building an allowlist of known IT admin accounts and their dedicated workstations: these can be excluded by AccountName combined with DeviceName. For monitoring agents and backup products, identify their specific parent process names (e.g., beremote.exe for Backup Exec, VeeamAgent.exe for Veeam) and add parent-process exclusions rather than blanket account exclusions. Consider tiering alert severity by context: a single 'net share' command on an identified admin workstation during business hours warrants low-severity notification, while 'net view /all /domain' from a standard user endpoint at 3 AM co-occurring with other discovery commands should auto-escalate to critical. Highest confidence signals requiring immediate investigation regardless of context: (1) net.exe spawned by document applications or scripting engines, (2) offensive tooling (CrackMapExec, NBTscan) which have no legitimate enterprise use, (3) discovery command clusters with 3+ techniques within 5 minutes, and (4) share enumeration immediately followed by new SMB connections to internal hosts. For environments with Active Directory, enabling Object Access auditing for network share access (Security Policy: Audit File Share) and capturing Event IDs 5140 and 5145 on critical file servers provides valuable server-side telemetry that catches attackers using direct API calls (NetShareEnum via Conti, Cuba) that bypass process-based detections entirely.

Hunting Queries

Hunt for network share enumeration launched from unusual parent processes. Legitimate administrative use of net view/share typically originates from cmd.exe, PowerShell, or Explorer. When net.exe is spawned by document applications (winword.exe, excel.exe), scripting engines (wscript.exe, mshta.exe), browsers, or remote service processes, it is a strong indicator of malicious execution within an attack chain — consistent with phishing-delivered malware performing automated post-exploitation discovery.

Hunting — KQL
kql 
// Hunt for share enumeration spawned by unusual parent processes (not cmd.exe, PowerShell, or Explorer)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has_any (" view", " share")
| where InitiatingProcessFileName !in~ (
    "cmd.exe", "powershell.exe", "pwsh.exe", "explorer.exe",
    "conhost.exe", "bash.exe"
)
| summarize
    Count=count(),
    Devices=dcount(DeviceName),
    Accounts=make_set(AccountName),
    Commands=make_set(ProcessCommandLine)
  by InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (match(lower(Image), "\\\\net(1)?\\.exe$"))
  (match(lower(CommandLine), "(\\bview\\b|\\bshare\\b)"))
  NOT (ParentImage="*\\cmd.exe" OR ParentImage="*\\powershell.exe" OR ParentImage="*\\pwsh.exe" OR ParentImage="*\\explorer.exe" OR ParentImage="*\\conhost.exe")
| stats count as Count, dc(host) as Devices, values(User) as Accounts, values(CommandLine) as Commands by ParentImage, ParentCommandLine
| sort - Count

Hunt for discovery command clustering — multiple distinct reconnaissance tools executed from the same host and user within a 5-minute window that includes share enumeration. Ransomware operators (Conti, Medusa, BlackByte) and post-exploitation frameworks (Cobalt Strike, Metasploit, Sliver, Havoc) execute automated discovery playbooks after initial compromise. Three or more distinct discovery binaries used within 5 minutes of net view/net share is a high-fidelity indicator of active attacker presence.

Hunting — KQL
kql 
// Hunt for discovery command clusters - 3+ recon techniques from same host within 5 minutes
let DiscoveryBehaviors = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe", "systeminfo.exe", "ipconfig.exe", "whoami.exe",
                      "nltest.exe", "nbtstat.exe", "arp.exe", "route.exe", "netstat.exe")
   or (FileName in~ ("powershell.exe", "pwsh.exe") and
       ProcessCommandLine has_any ("Get-SmbShare", "Win32_Share", "Get-ADDomain", "Get-NetLocalGroup", "Get-NetUser"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine;
DiscoveryBehaviors
| join kind=inner (
    DiscoveryBehaviors
    | where FileName in~ ("net.exe", "net1.exe")
    | where ProcessCommandLine has_any (" view", " share")
    | project PivotTime=Timestamp, DeviceName, AccountName
) on DeviceName, AccountName
| where abs(datetime_diff('second', Timestamp, PivotTime)) <= 300
| summarize
    TechniqueCount=dcount(FileName),
    CommandCount=count(),
    Tools=make_set(FileName),
    Commands=make_set(ProcessCommandLine)
  by DeviceName, AccountName, bin(PivotTime, 5m)
| where TechniqueCount >= 3
| sort by TechniqueCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (match(lower(Image), "\\\\(net(1)?|systeminfo|ipconfig|whoami|nltest|nbtstat|arp|route|netstat)\\.exe$")
   OR (match(lower(Image), "\\\\(powershell|pwsh)\\.exe$") AND match(lower(CommandLine), "(get-smbshare|win32_share|get-addomain|get-netlocalgroup)")))
| bucket _time span=5m
| stats dc(Image) as ToolCount, count as CmdCount, values(Image) as Tools, values(CommandLine) as Commands by _time, host, User
| where ToolCount >= 3
| sort - ToolCount

Hunt for SMB connections that follow network share enumeration from the same host within a 10-minute window. Conti, QakBot, and BlackByte ransomware enumerate shares and then immediately pivot to those shares for lateral movement, tool transfer, or data staging. New outbound SMB connections (port 445) to internal hosts shortly after share discovery is one of the clearest behavioral indicators of an attacker transitioning from reconnaissance to active lateral movement.

Hunting — KQL
kql 
// Hunt for SMB lateral movement immediately following share enumeration on the same device
let ShareDiscovery = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has_any (" view", " share")
| project DiscoveryTime=Timestamp, DeviceName, AccountName, DiscoveryCmd=ProcessCommandLine;
ShareDiscovery
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemotePort == 445
    | where RemoteIPType !in ("Loopback", "LinkLocal")
    | project ConnectionTime=Timestamp, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
) on DeviceName
| where ConnectionTime > DiscoveryTime
| where ConnectionTime < datetime_add('minute', 10, DiscoveryTime)
| project
    DiscoveryTime, ConnectionTime,
    SecondsAfterDiscovery=datetime_diff('second', ConnectionTime, DiscoveryTime),
    DeviceName, AccountName, DiscoveryCmd,
    RemoteIP, RemoteUrl, InitiatingProcessFileName
| sort by DiscoveryTime desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  match(lower(Image), "\\\\net(1)?\\.exe$") (match(lower(CommandLine), "\\bview\\b") OR match(lower(CommandLine), "\\bshare\\b"))
| eval disc_time=_time, host_key=host
| table disc_time, host_key, User, CommandLine
| join type=inner host_key [
    search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
    DestinationPort=445
    NOT (DestinationIp="127.*" OR DestinationIp="::1")
    | eval conn_time=_time, host_key=host
    | table conn_time, host_key, DestinationIp, DestinationHostname, Image
  ]
| where conn_time > disc_time AND conn_time < disc_time+600
| eval SecondsLater=conn_time-disc_time
| table disc_time, conn_time, SecondsLater, host_key, User, CommandLine, DestinationIp, DestinationHostname, Image
| sort - disc_time

Atomic Red Team Tests

Test 1 Enumerate Local Shares with net share
windows

Uses the built-in net.exe to list all shared resources on the local system. This is the simplest form of share discovery, used by Kwampirs (Symantec 2018) and QakBot to identify what the compromised host is sharing before probing the wider network. Generates a process creation event with 'net share' in the command line and produces output listing all local shares including administrative shares (C$, ADMIN$, IPC$).

Command

powershell 
net share

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe (or net1.exe), CommandLine='net share', ParentImage=cmd.exe or powershell.exe. Security Event ID 4688 if command line auditing is enabled via GPO.

Expected Detection

Alert fires on FileName=net.exe with 'share' in ProcessCommandLine. KQL: IsLocalShare=true. SPL: IsLocalShare=1, SuspicionScore=1.

Test 2 Enumerate All Domain Network Shares with net view /all
windows

Uses net.exe to enumerate all shared resources across the entire domain — the broadest form of share discovery. Used verbatim by Latrodectus ('net view /all'), and functionally equivalent to Conti and BlackByte domain-wide enumeration. This command generates significant SMB/NetBIOS network traffic and enumerates every accessible share across domain-joined hosts.

Command

powershell 
net view /all /domain

Expected Telemetry

Sysmon Event ID 1: Process Create with CommandLine='net view /all /domain'. Sysmon Event ID 3: Multiple outbound SMB connections (port 445) to domain controllers and other hosts. Windows Security Event ID 5145 on accessed servers for each share access check. DNS queries for domain host resolution.

Expected Detection

Alert fires on net.exe with both 'view' and '/all'. KQL: IsRemoteView=true, IsNetAllDomain=true. SPL: IsRemoteView=1, IsNetAllDomain=1, SuspicionScore=2. Highest priority alert variant due to domain-wide enumeration scope.

Test 3 Query Specific Remote Host Shares via UNC Path
windows

Uses net view with a specific UNC path to enumerate shares on a targeted remote system. This targeted variant is the pattern seen in BADHATCH (checking C$ share access on compromised machines) and post-exploitation frameworks that identify high-value targets (file servers, DCs) and enumerate them individually. Using %COMPUTERNAME% keeps this test safe by querying the local machine's own shares via the network stack.

Command

powershell 
net view \\%COMPUTERNAME%

Expected Telemetry

Sysmon Event ID 1: Process Create with CommandLine containing 'net view \\\\' followed by the resolved hostname. Sysmon Event ID 3: SMB connection to the target host on port 445. Windows Security Event ID 5140 and 5145 on the target host recording the source account and enumerated share names.

Expected Detection

Alert fires on net.exe with 'view' and UNC path (\\\\). KQL: IsRemoteView=true. SPL: IsRemoteView=1, SuspicionScore=1.

Test 4 PowerShell WMI Network Share Enumeration via Win32_Share
windows

Uses PowerShell with the WMI Win32_Share class to enumerate all shares — both local and those accessible via WMI. This method avoids spawning net.exe and bypasses process-name based detections, using instead a WMI query that returns share objects. Conti ransomware uses the equivalent NetShareEnum() Win32 API call; this test exercises the PowerShell/WMI path that emulates that behavior at a higher abstraction level.

Command

powershell 
powershell.exe -NoProfile -Command "Get-WmiObject -Class Win32_Share | Select-Object Name, Path, Type, Description | Format-Table -AutoSize"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Win32_Share'. PowerShell ScriptBlock Log Event ID 4104 with the full WMI query and returned share objects. Module load events (Sysmon Event ID 7) for WMI-related DLLs.

Expected Detection

Alert fires on PowerShell with 'Win32_Share' in ProcessCommandLine. KQL: IsPowerShellWmi=true. SPL: IsPowerShellEnum=1, SuspicionScore=1.

Test 5 SMB Share Enumeration via PowerShell Get-SmbShare Cmdlet
windows

Uses the PowerShell SmbShare module cmdlet to enumerate local SMB shares — a modern, operator-friendly approach increasingly seen in red team engagements and living-off-the-land post-exploitation. Get-SmbShare returns richer share metadata than net share and is harder to detect with simple string matching due to its benign administrative appearance. Tests whether detection logic covers PowerShell SMB module usage.

Command

powershell 
powershell.exe -NoProfile -Command "Get-SmbShare | Select-Object Name, Path, ScopeName, ShareState, ConcurrentUserLimit | Format-Table -AutoSize"

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-SmbShare'. PowerShell ScriptBlock Log Event ID 4104 with the full cmdlet invocation and output. Sysmon Event ID 7: Module load for SmbShare module DLLs (Microsoft.SMBServer.*).

Expected Detection

Alert fires on PowerShell with 'Get-SmbShare'. KQL: IsPowerShellWmi=true. SPL: IsPowerShellEnum=1, SuspicionScore=1.

Related Detections

Tactic Hub

TA0007Discovery

Related Techniques

T1021.002SMB/Windows Admin SharesT1039Data from Network Shared DriveT1083File and Directory DiscoveryT1016System Network Configuration DiscoveryT1018Remote System DiscoveryT1087.002Domain AccountT1069.002Domain GroupsT1570Lateral Tool TransferT1486Data Encrypted for ImpactT1074.002Remote Data Staging

Same Tactic: Discovery

Popular Detections