Technique:  Network Share Discovery
It listed connected network shares.
It used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$.
It has enumerated network shares on a compromised host.
It has used the post exploitation tool CrackMapExec to enumerate network shares.
It used the net share command as part of network reconnaissance.
Avaddon has enumerated shared folders and mapped volumes.
AvosLocker has enumerated shared drives on a compromised network.
Babuk has the ability to enumerate network shares.
Bad Rabbit enumerates open SMB shares on internal victim networks.
BADHATCH can check a user's access to the C$ share on a compromised machine.
Bazar can enumerate shared drives on the domain.
BitPaymer can search for network shares on the domain or workgroup using net view .
BlackCat has the ability to discover network shares on compromised networks.
During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.
It has used net share and net view to identify network shares of interest.
Clambling has the ability to enumerate network shares.
Clop can enumerate network shares.
Cobalt Strike can query shared drives on the local system.
Conti can enumerate remote open SMB network shares using NetShareEnum().
CrackMapExec can enumerate the shared folders and associated permissions for a targeted network.
Cuba can discover shared resources using the NetShareEnum API call.
It scanned the network for public shared folders.
DEATHRANSOM has the ability to use loop operations to enumerate network resources.
Diavol has a ENMDSKS command to enumerates available network shares.
It has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.
Emotet has enumerated non-hidden network shares using WNetEnumResourceW.
Empire can find shared drives on the local system.
It has executed net view commands for enumeration of open shares on compromised machines.
FIVEHANDS can enumerate network shares and mounted drives on a network.
Flagpro has been used to execute net view to discover mapped network shares.
HELLOKITTY has the ability to enumerate network resources.
InvisiMole can gather network share information.
Koadic can scan local network for open SMB.
KOPILUWAK can use netstat and Net to discover network shares.
Kwampirs collects a list of network shares with the command net share.
MURKYTOP has the capability to retrieve information about shares on remote hosts.
The net view \remotesystem and net share commands in Net can be used to find shared drives and directories on remote and local systems respectively.
Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.
During Operation CuckooBees, the threat actors used the net share command as part of their advanced reconnaissance.
During Operation Wocao, threat actors discovered network disks mounted to the system using netstat.
OSInfo discovers shares on the network
PlugX has a module to enumerate network shares.
Pupy can list local and remote shared drives and folders over SMB.
QakBot can use net share to identify network shares for use in lateral movement.
QuietSieve can identify and search networked drives for specific file name extensions.
Ramsay can scan for network drives which may contain documents for collection.
Royal can enumerate the shared resources of a given IP addresses using the API call NetShareEnum.
Sardonic has the ability to execute the net view command.
ShimRat can enumerate connected drives for infected host machines.
SILENTTRINITY can enumerate shares on a compromised host.
It listed remote shared drives that were accessible from a victim.
Stuxnet enumerates the directories of a network resource.
It has used tools such as NBTscan to enumerate network shares.
TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.
It used netview to scan target systems for shared resources.
WastedLocker can identify network adjacent and accessible drives.
WhisperGate can enumerate connected remote logical drives.
It has used the "net view" command to locate mapped network shares.
Zebrocy identifies network drives when they are added to victim systems.