File shares hold years of contracts, HR records, finance exports and scripts with embedded passwords, and any account that can map a drive can usually read far more of them than its owner ever needs. MITRE ATT&CK tracks the collection of that data as T1039 Data from Network Shared Drive, a Collection (TA0009) technique on Linux, macOS and Windows. Ransomware crews collect from shares before encrypting, and espionage groups have used them as their main source of documents. This guide is for detection engineers and file server owners, and takes the technique view: what ATT&CK v20 says, real procedures, the v20 detection analytics, controls and testing. Share permission design and clean-up are covered in the Unstructured Data and File Share Security Guide, and the tactic overview in the ATT&CK Collection Tactic Guide.
Key takeaways
- Discovery comes first. Attackers enumerate shares with T1135 Network Share Discovery, then collect under T1039. Alert on the pair.
- Log on the server, not the client. Windows event 5145 (Audit Detailed File Share) is generated every time a network share object is accessed, on the host that serves the share.
- Volume and breadth are the signals. One account reading thousands of files across many folders it has never touched, often with a copy tool such as Robocopy, is the T1039 shape.
- ATT&CK maps no mitigations. Least privilege on shares, data minimisation and egress control are NHI Mgmt Group recommendations, not ATT&CK v20 mitigations.
- Service accounts are the quiet risk. Backup, indexing and migration accounts often read every share, so a stolen one collects everything without looking unusual.
What the technique covers
ATT&CK v20 (technique version 1.6, last modified 2 September 2026) describes adversaries searching network shares on compromised computers to find files of interest, collecting sensitive data from remote systems via shared network drives (host shared directory, network file server and so on) accessible from the current system prior to exfiltration. Interactive shells and cmd may be used. T1039 has no sub-techniques.
| Technique | What it is | How it differs from T1039 |
|---|---|---|
| T1135 Network Share Discovery | Listing shares and their permissions | Finds the shares; no file content is read |
| T1039 Data from Network Shared Drive | Reading and gathering files from shares | The collection step |
| T1005 Data from Local System | Gathering files on the compromised host itself | Local disk, not remote shares |
| T1021.002 SMB/Windows Admin Shares | Using admin shares to move laterally | Lateral movement, though DET0410 watches the same admin shares |
| T1080 Taint Shared Content | Planting malicious files on shares | Writes to shares rather than reading from them |
How adversaries use it: real cases
Procedure examples from the ATT&CK v20 data, with the source ATT&CK cites:
- C0015 (2021): threat actors collected files from network shared drives prior to network encryption (The DFIR Report, Conti and Bazar, November 2021). This is the double extortion pattern; see the Conti Ransomware Profile Guide.
- menuPass (G0045): collected data from remote systems by mounting network shares with
net useand transferring data with Robocopy (PwC Cloud Hopper, April 2017). - APT28 (G0007): collected files from network shared drives (joint cybersecurity advisory on the GRU brute force campaign, July 2021).
- Fox Kitten (G0117): searched network shares to access sensitive documents (CISA advisory AA20-259A, September 2020).
- NIMBUS MANTICORE (G1059): collected data from SMB shares within the victim network (Mandiant, November 2025).
- Gamaredon Group (G0047): malware collected Microsoft Office documents from mapped network drives (ESET, 2020 and 2024).
- BADNEWS (S0128): on start-up crawls the victim's mapped drives and collects .doc, .docx, .pdf, .ppt, .pptx and .txt files (Forcepoint).
- Sowbug (G0054): extracted Word documents from a file server on a victim network (Symantec, November 2017).
Two shapes recur: automated malware crawling every mapped drive for document extensions, and hands-on operators mounting shares with native tools and bulk copying before exfiltration or encryption.
What to detect and where
ATT&CK v20 detection strategy DET0410, Detection Strategy for Data from Network Shared Drive, has three analytics.
| Platform | Analytic (ATT&CK) | Data components and log sources (from ATT&CK) | Practical rule |
|---|---|---|---|
| Windows | AN1145: access to network shares (for example C$, Admin$) followed by unusual read or copy operations by processes not typically associated with such activity (for example PowerShell, certutil) | Network Share Access (Security 5145); File Creation (Sysmon 11) | On the server: one account and source address producing 5145 events across many folders in a short window. On the client: a script host writing many files copied from a UNC path |
| Linux | AN1146: unusual access or copying of files from mounted NFS or CIFS/SMB drives by user shells or scripts, followed by large data transfer | File Access (auditd open, read); Drive Access (syslog mount and umount) | New mount of a share followed by recursive reads, archiving or outbound transfer |
| macOS | AN1147: file access from mounted SMB shares followed by copy or exfiltration commands from Terminal or script interpreters | File Access (unified log); Drive Access (fs_usage open, read, mount) | Interpreter processes reading many files under a mounted share |
Using event 5145 well
- Where it lands: 5145 is logged under Audit Detailed File Share on the computer hosting the share. Fields include
ShareName,RelativeTargetName,AccessList,IpAddressand the subject's logon ID for correlation with 4624. - Volume: it fires on every access, so on busy file servers forward it selectively: sensitive shares first, or aggregate counts per account and source on the server before sending.
- Blind spot: Microsoft notes failure events are generated only when access is denied at share level, not when NTFS denies it. Do not rely on 5145 failures to see probing of NTFS-protected folders.
- NAS and cloud file services: many NAS platforms and managed file services have their own audit logs; turn them on and send them to the SIEM, since Windows events will not exist there.
Behaviour baselines
- Breadth: distinct folders or shares touched per account per hour, compared with the account's own history.
- Volume: bytes or files read per account, with peer-group comparison (same department or role).
- Tooling: Robocopy, xcopy, PowerShell copy commands or rclone run against UNC paths from workstations; see Detecting Rclone and File-Sync Exfiltration Tooling.
- Canary files: decoy documents with attractive names in sensitive shares; any read is worth a look.
- Sequence: share enumeration (T1135), then bulk reads, then archiving (T1560, see the T1560 guide) or encryption activity.
Controls
ATT&CK v20 lists no mitigations for T1039. The controls below are NHI Mgmt Group recommendations.
| Control | Effect on T1039 | Notes |
|---|---|---|
| Remove broad groups from share and NTFS permissions | Shrinks what any one account can read | "Everyone", "Authenticated Users" and "Domain Users" grants are the main exposure; see the Unstructured Data and File Share Security Guide |
| Access-based enumeration | Users see only folders they can open | Reduces discovery noise; it does not change permissions |
| Data minimisation and archiving | Less to steal | Move stale data to restricted archives; delete what retention rules allow |
| Sensitivity labelling and DLP | Flags or blocks movement of classified files | See the Data Loss Prevention (DLP) Guide |
| SMB signing and NTLM reduction | Makes relayed credentials less useful for share access | See the SMB Signing Guide and NTLM Relay Guide |
| Egress control from file servers and workstations | Collected data is harder to move out | Pairs with exfiltration detection; see the Data Exfiltration Guide |
Where identity fits
T1039 runs with whatever access the stolen account has, so the identity with the widest share access is the most valuable to an attacker. That is rarely a person. Backup agents, search indexers, antivirus scanners, migration tools and sync services often hold read on every share, and their bulk reads look normal by design. Give each of these service accounts read only on the shares it serves, deny interactive logon, restrict the hosts it can authenticate from, and baseline its read pattern so an off-schedule or off-host read stands out. Scripts on shares are another identity risk: logon scripts and admin scripts often hold service account passwords in plain text, so collection from shares frequently becomes credential theft (see MITRE ATT&CK T1552 Unsecured Credentials Guide).
Decision guidance
- Small organisations: remove broad groups from the few shares that matter, turn on 5145 auditing for those shares, and alert on bulk reads by any one account.
- Large organisations: use a data access governance tool or file activity monitoring to baseline per-account behaviour across thousands of shares, and feed alerts to the SOC.
- Organisations moving to cloud file services: do not migrate broad permissions as they are; clean them up first and turn on the service's audit log from day one.
How to test and roll out
- Find sensitive shares: classify shares by data held, and list who can read each.
- Enable auditing: Audit Detailed File Share on servers holding sensitive shares; equivalent audit on NAS and cloud file services.
- Emulate: an authorised tester, using a test account on a pilot share, enumerates shares and bulk-copies planted test documents with native tools, mapped to T1039.
- Tune: confirm the breadth and volume rules fire; name backup, indexing and scanning accounts with their expected hosts and schedules rather than excluding them wholesale.
- Tighten permissions in waves: remove broad groups share by share with owners' sign-off.
- Roll back: if a business process breaks, restore the specific group to the specific share and record it as a reviewed exception.
Metrics
- Sensitive shares still granting access to broad groups.
- Share of sensitive shares with access auditing forwarded to the SIEM.
- Service accounts with read on all shares, trending down.
- Time from emulated bulk collection to alert triage.
Common failure patterns
- Auditing on clients only: endpoint telemetry misses access from unmanaged or attacker-controlled hosts; the server sees every request.
- Excluding service accounts from monitoring: the accounts with the broadest read become the least watched.
- Relying on failure events: NTFS-level denials do not produce 5145 failures.
- Ignoring NAS and cloud shares: data moves to platforms where Windows auditing does not apply.
- Treating collection as normal file use: without per-account baselines, a ransomware crew's bulk copy looks like a busy day.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1039; TA0009; DET0410 | Technique and detection strategy |
| MITRE ATT&CK (related) | T1135; T1005; T1560; T1486 | Discovery before, archiving and encryption after |
| NIST SP 800-53 Rev 5 | AC-3 Access Enforcement; AC-6 Least Privilege | Share and NTFS permissions |
| NIST SP 800-53 Rev 5 | AU-2 Event Logging; AU-12 Audit Record Generation; SI-4 System Monitoring | Share access auditing and monitoring |
| NIST CSF 2.0 | PR.AA-05; PR.DS-01; ID.AM-07; DE.CM-09 | Least privilege, data at rest, data inventory, monitoring |
Practitioner checklist
- Enable Audit Detailed File Share on servers that host sensitive shares.
- Alert on one account reading many folders or files in a short window.
- Alert on copy tools run against UNC paths from workstations.
- Remove Everyone, Authenticated Users and Domain Users from sensitive shares.
- Scope backup, indexing and scanning service accounts to their shares and hosts.
- Remove plaintext credentials from scripts stored on shares.
- Turn on audit logs for NAS and cloud file services.
- Place canary documents in high-value shares.
Standards and references
- MITRE ATT&CK: Data from Network Shared Drive (T1039)
- MITRE ATT&CK: Network Share Discovery (T1135)
- MITRE ATT&CK: C0015
- Microsoft: 5145(S, F) A network share object was checked to see whether client can be granted desired access
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: ATT&CK Collection Tactic Guide · Unstructured Data and File Share Security Guide · T1135 Network Share Discovery Defensive Guide · Insider Data Theft Guide · Detecting Rclone and File-Sync Exfiltration Tooling