T1039 Data from Network Shared Drive

Technique

T1039

Tactics

Collection

Research, 90 days

2

KEV CVEs mapped

0

SigmaHQ rules

2

Elastic, Splunk

7

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1039

MITRE description

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.(Citation: Net Use)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
• 2026-10-28 ReliaQuest: Residential Proxies Mask Social-Engineering Attacks

Detection coverage

SigmaHQ community rules

• Suspicious Access to Sensitive File Extensions (core)
• Copy From Or To Admin Share Or Sysvol Folder (core)

Elastic and Splunk rules

• Unusual Remote File Size (elastic)
• First Time Seen NFS AUTH_SYS Root UID Access (elastic)
• PowerShell Share Enumeration Script (elastic)
• PowerShell Suspicious Discovery Related Windows API Functions (elastic)
• Potential Network Share Discovery (elastic)
• Windows Network Enumeration (elastic)
• Windows Network Share Interaction Via Net (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.