T1039 Data from Network Shared Drive
Adversaries may search network shares on computers they have compromised to find files of interest. MITRE ATT&CK
1 Sigma rule T1039 on attack.mitre.org
Sigma rules tagged with it
mediumCopy From Or To Admin Share Or Sysvol FolderFlorian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali · Windows
Command lines CmdID reads as it
Copy a mandatory snippet from a folder to a destination folder on the page for New-IseSnippet
$path = "$HOME\Documents\WindowsPowerShell\Snippets\Mandatory.Snippets.ps1xml"
$destination = "\\Server\Share"
Copy-Item -Path $path -Destination $destinationIdentifyAn example is here when CmdID’s reading of it names T1039: a Sigma rule it trips is tagged with it, or its abuse is documented as it.