T1135 — Network Share Discovery

Tactic: Discovery · Platforms: Linux, macOS, Windows

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable…

Sigma detection rules (3)

T1135 Network Share Discovery

title: T1135 Network Share Discovery
id: 7808df29-125d-4e9f-946d-45bbacdd8056
description: 'Detects net.exe/net1.exe view/share command-line enumeration. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: BurstHostThreshold, TimeWindow, AllowedDiscoveryAccounts, PipeNameAllowList.'
references:
  - https://attack.mitre.org/techniques/T1135
author: Shahrukh Khan
date: 2026-05-17
license: MIT
tags:
  - attack.discovery
  - attack.t1135

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_img:
    EventID: '1'
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
  selection_cmd:
    CommandLine|contains:
      - 'view'
      - 'share'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_img and selection_cmd and not filter_system_account

falsepositives:
  - Standard IT troubleshooting.

level: medium

T1135 Network Share Discovery

title: T1135 Network Share Discovery
id: a9af025e-c170-481d-b1a3-b7ff57bdf460
description: 'Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BurstHostThreshold, TimeWindow, ApprovedInventoryHosts.'
references:
  - https://attack.mitre.org/techniques/T1135
author: Shahrukh Khan
date: 2026-02-01
license: MIT
tags:
  - attack.discovery
  - attack.t1135

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/showmount'
      - '/smbclient'
    a1|contains: '-L'

  condition: selection

falsepositives:
  - showmount/smbclient -L are used legitimately by admins and monitoring tools to inventory available shares; burst-across-hosts scoring described in tuning fields requires SIEM-side aggregation beyond a single auditd record.

level: medium

T1135 Network Share Discovery

title: T1135 Network Share Discovery
id: e929cd1c-0105-4570-9089-37d113174fa1
description: 'Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BurstHostThreshold, TimeWindow, AllowedMgmtTools.'
references:
  - https://attack.mitre.org/techniques/T1135
author: Shahrukh Khan
date: 2026-02-18
license: MIT
tags:
  - attack.discovery
  - attack.t1135

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/smbutil'
      - '/mount_smbfs'
    CommandLine|contains: 'view'

  condition: selection

falsepositives:
  - Users and IT scripts routinely list available SMB shares with smbutil view for legitimate connectivity checks.

level: low

Explore