Network Share Discovery (T1135) is the moment an intruder works out where your files live, and it comes before two of the most expensive outcomes in the playbook: mass encryption of file servers and harvesting of passwords, keys and connection strings left in shared folders. ATT&CK v20 lists T1135 under Discovery (TA0007) on Windows, Linux and macOS, with almost 80 procedure examples ranging from state groups to ransomware operators such as Medusa, Wizard Spider and BlackByte. Unlike many discovery techniques, share enumeration leaves a network footprint: one host touching SMB on many others in minutes. This page covers why adversaries enumerate shares, the behaviour chain ATT&CK v20 tells you to detect, the Windows events and network data that carry it, decoy shares, hardening, and how to test. It is written for detection engineers and file server owners; commands are named only where a detection needs them.
Key takeaways
- Detect the fan-out, not the command. ATT&CK v20's detection strategy DET0182 chains a share enumeration call with a burst of SMB or RPC connections to many hosts (it suggests 5 or more in 10 minutes), which is far stronger than matching net view alone.
- It is a ransomware precursor. CISA's March 2025 Medusa advisory records the actors querying shared drives with net share before deploying the encryptor across the network.
- Shares are also a secrets store. Public red team tooling such as Snaffler enumerates every readable share in a domain and flags files named like keys, password vaults or configs containing connection strings, so whatever an attacker can read, they can mine.
- Decoy shares give near-zero-noise alerts. A share no legitimate user has a reason to open, audited with event 5145, turns enumeration and browsing into a high-confidence signal.
- Least privilege on shares limits blast radius. Restricting anonymous enumeration (the only v20 mitigation, M1028) and removing broad Everyone or Authenticated Users read access shrinks what discovery can find.
What T1135 is and how adversaries use it
ATT&CK describes Network Share Discovery as looking for folders and drives shared on remote systems, both to find information to collect and to identify systems of interest for lateral movement. On Windows, sharing runs over SMB; ATT&CK names the built-in Net utility (S0039) querying remote shares with net view and local shares with net share, and the macOS sharing -l command. Under the hood, remote share listing on Windows is an RPC call (NetShareEnum or NetShareEnumAll on the srvsvc interface) carried over a named pipe on the IPC$ share, which is why named pipe and RPC telemetry are useful. The technique has no sub-techniques in v20.
What happens next decides the impact:
- Encryption targeting: the share list becomes the target list for Data Encrypted for Impact (T1486) and for deployment through admin shares (T1021.002). See the MITRE ATT&CK T1486 Data Encrypted for Impact.
- Collection: readable shares feed Data from Network Shared Drive (T1039) and staging for exfiltration.
- Secrets harvesting: scripts, deployment folders and config files on shares often hold service account passwords, API keys and private keys, which ATT&CK models as Credentials In Files (T1552.001). See the MITRE ATT&CK T1552 Unsecured Credentials Guide.
Real cases
| Actor or source | What was recorded | Detection lesson |
|---|---|---|
| Medusa (G1051), CISA AA25-071A | Queried shared drives on the local system (net share); used Advanced IP Scanner and SoftPerfect Network Scanner for early enumeration; then pushed the encryptor across the network with PsExec, PDQ Deploy or BigFix | Discovery and deployment tools are legitimate admin software, so the account and source host matter more than the binary |
| Wizard Spider (G0102) | Used net view to locate mapped network shares (ATT&CK, citing a 2020 DHS/CISA healthcare ransomware alert) | Classic ransomware precursor on Windows estates |
| APT32 (G0050) | Used net view to show all shares, including administrative shares such as C$ and ADMIN$ | Admin share listing from a workstation is unusual |
| APT39 (G0087) | Used CrackMapExec to enumerate network shares | Linux and offensive frameworks: watch the network, not just endpoints |
| Chimera (G0114) | Used net share and net view to identify shares of interest | Interactive discovery usually sits beside account and host discovery |
| BlackByte (G1043) | Enumerated network shares on victim devices (Cisco Talos, 2024) | Ransomware affiliates repeat the same pattern |
See the Medusa Ransomware Threat Actor Profile and the BlackByte Ransomware Profile Guide for the full intrusion chains.
What to detect and where
ATT&CK v20 detection strategy DET0182 is a behaviour chain: a process enumerates shares, then the same host opens SMB or RPC connections to many hosts in a short window, optionally followed by file listing or copying.
| Platform | Enumeration signal | Fan-out signal | Log sources named in v20 |
|---|---|---|---|
| Windows (AN0513) | net view or net share, PowerShell Get-SmbShare or WMI, srvsvc NetShareEnum or NetShareEnumAll RPC from unusual processes | Outbound TCP 445 or 139 and \\host\IPC$ srvsvc connections to many hosts | Security 4688, Sysmon 3 and 22, Sysmon 17 (named pipe), PowerShell 4103 to 4106, Microsoft-Windows-RPC ETW |
| Linux (AN0514) | smbclient -L, smbmap, rpcclient, nmblookup, crackmapexec smb | TCP 139 or 445 to multiple hosts; TreeConnect to IPC$ in Zeek or flow data | auditd EXECVE, network sensor flow and SMB logs |
| macOS (AN0515) | sharing -l, smbutil view, mount_smbfs | Outbound SMB to multiple destinations | Endpoint Security exec events, unified log, firewall and flow logs |
Windows server-side events
| Event | Audit subcategory | Use for T1135 |
|---|---|---|
| 5140 A network share object was accessed | Audit File Share | One host connecting to IPC$ or many shares across many servers in minutes |
| 5145 Network share object access check | Audit Detailed File Share | Per-file access with account, source IP, ShareName, RelativeTargetName and AccessMask; ideal on decoy shares |
| 4624 logon type 3 | Audit Logon | Correlate SubjectLogonId from 5145 to the network logon and its account |
Microsoft notes that 5145 is generated each time a share object is accessed, so on busy file servers enable it selectively (decoy shares, sensitive shares) rather than everywhere, and prioritise write, delete and permission change rights in failures.
Tuning
- Start from the v20 thresholds: BurstHostThreshold of 5 or more unique SMB destinations and a 10 minute TimeWindow, then adjust per segment. Workstations rarely talk SMB to more than a handful of file servers.
- Allow-list scanners by host and account: vulnerability scanners, inventory tools and backup servers enumerate shares legitimately. Use the ApprovedInventoryHosts and AllowedDiscoveryAccounts elements v20 lists, and alert when those accounts are used from any other host.
- Watch for workstation to workstation SMB: in most estates clients do not serve shares to each other, so lateral SMB between user subnets is a strong signal on its own.
- Combine with the next step: a share enumeration burst followed by mass reads of .config, .ps1, .xml or key files, or by admin share writes, should raise severity sharply.
Honeyshares and decoys
A decoy share is an NHI Mgmt Group recommended control with an excellent signal to noise ratio. MITRE D3FEND models Decoy Network Resource (D3-DNR) and Decoy File (D3-DF) as deception techniques.
- Create a share with a believable name (for example a finance archive or an IT scripts folder) on a server already in the file estate, so it appears in any share listing.
- Seed it with decoy files such as a script containing a canary credential that alerts when used. See the Honeytokens and Canary Credentials Guide.
- Grant read to Domain Users so that automated tooling sees it as readable, and enable Audit Detailed File Share (5145) for that share only.
- Alert on any access to the share and on any use of the canary credential, with the source IP and account from 5145 as the pivot.
- Exclude it from backup, indexing and antivirus scans that would otherwise trigger it, and document it so administrators do not delete it.
See the Deception Technology Deployment Guide for running decoys at scale.
Where identity fits: secrets in shares
Share enumeration matters to identity teams because file shares are one of the most common places non-human credentials leak: deployment scripts with service account passwords, application config files with database connection strings, exported certificates and private keys, and password manager vault files. Snaffler's documentation describes its default behaviour as querying Active Directory for domain computers, connecting to each over SMB to find readable shares, and flagging files by extension (such as .kdbx or .ppk), exact names (such as id_rsa) and content patterns (such as password= or connectionString). Defenders can use the same idea, with authorisation, to find their own exposed secrets first.
- Scan your shares for secrets on a schedule and treat each hit as a credential to rotate, not just a file to delete.
- Move service credentials into a vault and reference them at runtime. See the Service Account Security Guide.
- Watch service accounts for share enumeration: a service account that suddenly lists shares on many hosts, or is used from a new source, is a high-value alert.
Mitigations and hardening
| Control | Setting or action | Effect on T1135 |
|---|---|---|
| M1028 Operating System Configuration (ATT&CK v20) | Group Policy "Network access: Do not allow anonymous enumeration of SAM accounts and shares" (Security Options), enabled | Blocks null session share enumeration; Microsoft notes it has no effect on domain controllers and that resources granting ANONYMOUS LOGON stay reachable |
| Share and NTFS least privilege (NHI Mgmt Group recommendation) | Remove Everyone and Authenticated Users from share and folder ACLs; use role groups and access reviews | Enumeration finds less that is readable |
| Access-based enumeration (NHI Mgmt Group recommendation) | Enable on file servers and DFS namespaces so users only see folders they can access | Reduces what a share listing reveals |
| Host firewall and segmentation (NHI Mgmt Group recommendation) | Block inbound TCP 445 and 139 to workstations; allow SMB only to designated file servers | Turns workstation fan-out into blocked, logged connections; CISA's Medusa advisory recommends segmentation and monitoring for unauthorised scanning |
| Remove unused and legacy shares | Inventory shares quarterly, retire orphaned and personal shares, disable SMBv1 | Fewer targets and fewer forgotten secrets |
See the Unstructured Data and File Share Security Guide for the permission model and the SMB Protocol Security and Signing Guide for protocol hardening.
How to test
- Baseline: 30 days of 5140 and SMB flow data, grouped by source host and account, to find legitimate fan-out sources.
- Emulate in an approved test ring: from a standard user workstation, list shares on several test servers with built-in tools, then browse the decoy share. Use an authorised emulation framework mapped to T1135, not ad hoc scripts.
- Check each layer fires: process rule, SMB fan-out rule, 5145 decoy alert and canary credential alert.
- Report-only then enforce: run the fan-out rule in report-only mode for two weeks, tune allow-lists, then promote. Roll back to report-only if a new scanner or backup job floods it, and add that source by host and account.
Measures: median time from first share enumeration to alert in tests, decoy share accesses per month (target zero legitimate), number of shares readable by Everyone or Authenticated Users, secrets found per share scan and time to rotate them, and percentage of workstations blocking inbound SMB.
Common failure patterns
- Endpoint-only detection: enumeration from Linux tooling or an unmanaged host never creates a Windows process event. Network flow and server-side 5140 data close the gap.
- Scanner accounts with no host binding: allow-listing an inventory account everywhere gives attackers who steal it a free pass.
- Wide-open legacy shares: Everyone read on old departmental shares means enumeration leads straight to collection and secrets.
- Secrets deleted but not rotated: removing a script with a hard-coded password from a share does not invalidate a credential that may already have been copied.
- Auditing 5145 everywhere: event volume overwhelms the SIEM and the subcategory gets switched off again. Scope it to decoy and sensitive shares.
Related techniques: T1018 Remote System Discovery, T1083 File and Directory Discovery and T1039 Data from Network Shared Drive.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK v20 | T1135, TA0007, DET0182, M1028 | Technique, analytics and mitigation |
| MITRE ATT&CK v20 | T1039, T1021.002, T1486, T1552.001 | Common follow-on techniques (each has its own page) |
| MITRE D3FEND | D3-DNR Decoy Network Resource, D3-DF Decoy File | Decoy share and decoy file controls |
| NIST SP 800-53 Rev 5 | AC-3, AC-6, SC-7, SI-4 | Access enforcement, least privilege, boundary protection, monitoring |
| NIST CSF 2.0 | PR.AA-05, PR.DS-01, DE.CM-01, DE.AE-02 | Permissions, data at rest, network monitoring, event analysis |
Practitioner checklist
- Enable the Group Policy that blocks anonymous enumeration of SAM accounts and shares on members and workstations.
- Deploy the SMB fan-out rule (5 or more hosts in 10 minutes) and tune allow-lists by host and account together.
- Enable Audit File Share (5140) on file servers and Audit Detailed File Share (5145) on decoy and sensitive shares.
- Stand up at least one decoy share with a canary credential and alert on any access.
- Block inbound SMB to workstations with host firewall policy.
- Remove Everyone and Authenticated Users from share ACLs and enable access-based enumeration.
- Scan shares for secrets on a schedule and rotate every credential found.
- Alert when service or scanner accounts enumerate shares from a new host.
Standards and references
- MITRE ATT&CK: T1135 Network Share Discovery
- CISA: #StopRansomware Medusa Ransomware (AA25-071A)
- Microsoft Learn: Network access: Do not allow anonymous enumeration of SAM accounts and shares
- Microsoft Learn: Event 5145 network share object access check
- MITRE D3FEND: Decoy Network Resource
- SnaffCon: Snaffler project documentation
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Discovery and Reconnaissance Techniques Guide · Unstructured Data and File Share Security Guide · Lateral Movement Guide · T1021 Remote Services · Active Directory Security Monitoring and Event IDs Guide