T1039 — Data from Network Shared Drive

Tactic: Collection · Platforms: Linux, macOS, Windows

Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration.…

Sigma detection rules (3)

T1039 Data from Network Shared Drive

title: T1039 Data from Network Shared Drive
id: eba19b12-129c-4a20-9d46-92d01bca0559
description: 'Detection Strategy for Data from Network Shared Drive. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: ShareName, ProcessName, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1039
author: Shahrukh Khan
date: 2026-02-08
license: MIT
tags:
  - attack.collection
  - attack.t1039

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID: '11'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1039 Data from Network Shared Drive

title: T1039 Data from Network Shared Drive
id: 4b57fb01-de64-4e8d-a942-6fef2ea802ac
description: 'Detection Strategy for Data from Network Shared Drive. Matching any PATH event under /mnt/ or /media/ was far too broad to indicate deliberate searching/collection of sensitive data versus routine file access. Narrowed to only sensitive/high-value file extensions (office docs, archives, keys, databases) referenced under those mount points. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MountPoint, UID, SensitiveExtensionList.'
references:
  - https://attack.mitre.org/techniques/T1039
author: Shahrukh Khan
date: 2026-04-08
license: MIT
tags:
  - attack.collection
  - attack.t1039

logsource:
  category: file_event
  product: linux

detection:
  selection:
    type: PATH
    name|startswith:
      - '/mnt/'
      - '/media/'
    name|endswith:
      - '.doc'
      - '.docx'
      - '.xls'
      - '.xlsx'
      - '.pdf'
      - '.zip'
      - '.pem'
      - '.key'
      - '.sql'
      - '.kdbx'

  condition: selection

falsepositives:
  - Legitimate access to sensitive-looking documents on a mounted network share as part of normal job duties; still lower-volume and higher-signal than matching every file reference under the mount.

level: low

T1039 Data from Network Shared Drive

title: T1039 Data from Network Shared Drive
id: 06feea15-00fb-4394-8895-1ad159f1e7f8
description: 'Detection Strategy for Data from Network Shared Drive. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ProcessPath, SharePath.'
references:
  - https://attack.mitre.org/techniques/T1039
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.collection
  - attack.t1039

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/mount_smbfs'
      - '/mount_afp'
      - '/mount_nfs'
  selection_read:
    CommandLine|contains: '/Volumes/'
  condition: selection and selection_read

falsepositives:
  - Normal use of mapped network shares by end users for day-to-day file access.

level: medium

Explore