ShareFinder: How Threat Actors Discover File Shares

Many of our reports focus on adversarial Tactics, Techniques, and Procedures (TTPs) along with the tools associated with them. After gaining a foothold in an environment, one challenge for all threat actors is discovery. One common target for discovery is the enumeration of network shares. Network shares are common targets of an intrusion to facilitate later actions on objectives such as data exfiltration or targets for ransomware encryption.

For this reason, it is important for defenders to be able to …

actions adversarial challenge data data exfiltration discover discovery encryption enumeration environment exfiltration file focus intrusion network objectives procedures ransomware reports sharefinder tactics target techniques threat threat actors tools ttps