Skip to content
Sign In
Learn

T1135

Network Share Discovery

What it is

Attackers list the shared folders on a network to find data worth taking and places to copy their tools. It is a technique under the Discovery tactic. File shares hold much of an organization's documents, so a sweep of shares across many servers is often an early step toward collection and theft.

How adversaries use it

The attacker asks one host or many for their shares, with built-in commands such as net view and net share, PowerShell, or an enumeration tool that sweeps every server it can reach. Each request opens a short connection to the target's file sharing service, so a sweep shows up as one source touching many file servers within minutes.

Detect it in Elastic

Data source: Windows process creation events; Windows Security events on file servers

Key fields

event.code: 1 (Sysmon) or 4688 (Windows Security) when the enumeration command starts process.name: the tool, such as net.exe process.command_line: the target host and options event.code: 5140 on the file server when a network share is accessed (Audit File Share) winlog.event_data.ShareName: the share that was accessed source.ip: the address the request came from winlog.event_data.SubjectUserName: the account that made it host.name, @timestamp

Example event

{
  "host": {
    "name": "ws-307.corp.example"
  },
  "user": {
    "name": "m.castell"
  },
  "event": {
    "code": "1"
  },
  "process": {
    "name": "net.exe",
    "parent": {
      "name": "wscript.exe"
    },
    "command_line": "net view \\\\fs-418.corp.example /all"
  },
  "@timestamp": "2026-06-02T14:12:47.360Z"
}

Prebuilt Elastic rule: Windows Network Enumeration

Hunt guidance

5140 is recorded only when Audit File Share is on, and only on the server being asked. Start on the workstation side: process.name: "net.exe" and process.command_line: *view*. Then, on file servers, look for one address making 5140 requests to many servers within a few minutes: event.code: 5140, grouped by source.ip. Give priority to listings started from an ordinary user's computer, listings that cover many servers within minutes, and listings that are followed quickly by activity on the servers they found.

Ruling out legitimate activity

Users browse shares, and backup, inventory and management tools list them on a schedule. Check whether the source is a known server or admin workstation, whether the timing matches a job, and whether the account normally works with file servers. A sweep of many servers from one ordinary workstation is rarely routine.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.