Detect Network Share Discovery by monitoring for a host querying many systems for shared folders, enumerating administrative shares, or listing SMB resources at unusual scale. Sudden access from a workstation, service account, or newly privileged identity often indicates reconnaissance. Baseline normal file-share access, then alert on bursts and broad internal scanning.
How Network Share Discovery shows up in telemetry
network share discovery is rarely a single event. It usually appears as a pattern of repeated SMB queries, share enumeration calls, and access attempts spread across many hosts in a short window. The signal becomes stronger when the activity is unusual for that user, workstation, or service account, especially when it targets administrative shares or broad internal segments instead of a known file server set.
Detection works best when you treat this as a baseline problem, not a signature problem. Normal file-share use is often repetitive and narrow, while discovery is broader, burstier, and more exploratory. That difference is what lets security teams distinguish routine access from reconnaissance.
At the telemetry level, look for a host querying many systems for shared folders, listing SMB resources at unusual scale, or touching many endpoints without a corresponding business workflow. In practice, that often means one identity is trying to map where data and remote access paths exist before moving laterally or staging theft.
Why the identity behind the scan matters
The most useful context is often who is doing the looking. A burst of share enumeration from a regular workstation, a service account that does not normally browse network resources, or a newly privileged identity is more suspicious than the same pattern from a managed admin host. That is why this detection should be tied to identity context, privilege changes, and host role, not just to raw SMB volume.
This is also where visibility gaps show up. If teams do not know which identities are allowed to enumerate shares, they cannot separate legitimate admin workflows from discovery activity. The same is true for service accounts that have inherited broad access and now look normal until they begin scanning outside their usual blast radius.
For a broader view of how share enumeration fits into movement and remote access abuse, the Lateral Movement Guide is a useful reference because it covers SMB admin shares and related detection patterns. The lifecycle and visibility side of the problem is also well covered in the NHI Lifecycle Management Guide, especially where discovery, inventory, and ownership determine whether access looks expected or suspicious.
What good detection rules need to capture
Good detections combine volume, breadth, and novelty. Alert when one endpoint probes many internal systems, when share listing expands across subnets, or when a principal suddenly touches administrative shares it has never used before. Correlate that with authentication events, privilege elevation, and host posture so you can separate normal administration from early-stage reconnaissance.
Also watch for scale changes, not just absolute counts. A small burst may be noise, but a sharp change from a user’s normal behavior, especially outside maintenance windows, is often more meaningful than a fixed threshold. If the same pattern repeats across multiple hosts, it can indicate a staged reconnaissance phase rather than a one-off troubleshooting task.
The practical goal is to flag discovery before it becomes remote execution, credential theft, or data access. If the activity is happening from a newly privileged identity, treat the privilege change itself as part of the alert, because the discovery may be the first use of the expanded access.
Risk and Threat Considerations
Network Share Discovery matters because it is often the first visible step in internal reconnaissance and lateral movement. The same behavior that helps an attacker map file servers and admin shares can also reveal where sensitive data, remote execution paths, or reusable credentials may be exposed.
Failure mechanism: An identity with enough internal reach can enumerate shares across many systems, learn where access is available, and then shift to higher-value targets without needing an exploit.
Impact: This increases the chance of follow-on intrusion, privileged access abuse, and rapid spread across the environment, especially when share access is broad, poorly baselined, or tied to overprivileged accounts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1135 — Network Share Discovery | Directly maps to internal share enumeration and SMB discovery behavior. |
| Recommendation — Map share enumeration telemetry to T1135 and alert on broad internal discovery bursts. | ||
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | Supports ongoing monitoring for unusual share discovery activity and behavior change. |
| Recommendation — Monitor network and identity telemetry for abnormal SMB share discovery patterns. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Relevant for reviewing logs that show unusual share enumeration and reconnaissance patterns. |
| Recommendation — Review audit data for bursty, broad share enumeration and escalate anomalies. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Supports collecting and analyzing logs needed to detect share discovery at scale. |
| Recommendation — Centralize and analyze logs that reveal SMB enumeration and unusual host-to-host probing. | ||
Practitioner Guidance
What to verify: Confirm whether the source host, account, and time of day match an approved admin workflow. If they do not, investigate whether the scan coincided with privilege elevation, remote admin use, or a new service deployment.
Decision rule: If share enumeration comes from an identity that should not be browsing network resources, treat it as suspicious even if no file access followed. The absence of a read or write action does not make the reconnaissance benign.
What practitioners underestimate: Share discovery often looks low severity until it is correlated with later movement. The most important judgement is whether the pattern broadens the attacker’s map of the environment, because that is what turns a simple scan into a meaningful precursor to compromise.
Practitioner takeaway: The best detections are behavior-based and identity-aware, because share discovery is valuable to attackers precisely when it looks like routine internal noise.