CmdID

CmdID / Techniques

T1135 Network Share Discovery

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. MITRE ATT&CK

1 program on CmdID 7 Sigma rules T1135 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
explorer.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
criticalPotential Dridex ActivityFlorian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems) · Windows
criticalTurla Group Lateral MovementMarkus Neis · Windows
highFile Explorer Folder Opened Using Explorer Folder Shortcut Via Shell@Kostastsale · Windows
highHackTool - SharpView Executionfrack113 · Windows
mediumPUA - Advanced IP Scanner ExecutionNasreddine Bencherchali (Nextron Systems), @ROxPinTeddy · Windows
mediumPUA - Advanced Port Scanner ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
lowNet.EXE ExecutionMichael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements) · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Start or stop a Windows service synchronously on the page for net

net start serviceIdentify

Show the folders currently shared over SMB on the page for net

net shareIdentify

Show users in a local security group on the page for net

net localgroup "Administrators"Identify

To display a list of all user accounts for the local computer, run the following command on the page for net user

net userIdentify

To display information about the user account TommyH, run the following command on the page for net user

net user tommyhIdentify

To set the sign-in time from 8 AM to 5 PM for the username MikeD using 24-hour notation, run the following command on the page for net user

net user miked /time:M-F,08:00-17:00Identify

To set the sign-in time from 8 AM to 5 PM for MikeD using 12-hour notation, run the following command on the page for net user

net user miked /time:M-F,8AM-5PMIdentify

To specify sign-in hours of 4 AM to 12 PM on Monday, 12 PM to 8 PM on Tuesday, and 8 AM to 5 PM Wednesday through Friday for username AnibalS, run the following command on the page for net user

net user anibals /time:M,4AM-12PM;T,12PM-8PM;W-F,8AM-5PMIdentify

An example is here when CmdID’s reading of it names T1135: a Sigma rule it trips is tagged with it, or its abuse is documented as it.