Network Share Discovery
Network share discovery enumerates shared folders and storage locations.
What it means
Network share discovery enumerates shared folders and storage locations. The discovered names can guide later collection or movement without proving data access occurred.
An investigation example
A suspicious process lists shares on several internal servers and then reads documents from one selected share.
Evidence to examine
Correlate share enumeration, network destinations, caller identity, file access, and local staging.
A common analytical pitfall
Enumerating a share is not the same as reading every file it contains.
Response considerations
Scope enumeration and actual access separately, preserving client and server evidence and reviewing overly broad share visibility.
A share listing reveals possible storage paths
Network shares provide access to remote storage under defined permissions. Discovering their names or locations can help an intruder choose data sources or potential destinations. Listing a share does not automatically establish that its contents were readable or writable. Share-level and underlying filesystem permissions can both influence actual access.
Legitimate file browsers, support tools, and inventory processes may enumerate shares. Assess the source host, identity, process, scope, and timing. A broad search from an unexpected workstation can merit attention, especially when followed by access to sensitive locations, but context remains necessary before assigning intent.
A fictional shared-folder sequence
An academy sees a process list available shares and then attempt to open an assessment folder. File-service records show that some requests were denied and one was permitted. Analysts preserve the outcomes and compare them with the identity's expected role. The report should not describe every discovered share as compromised.
Names and mappings can be ambiguous. A drive letter may refer to a remote path, and aliases can point to the same underlying storage. Record the server and share context so the investigation does not confuse a local folder with a network resource. A later permission review may differ from the state during the incident, so preserve historical evidence where possible.
Separate discovery, read, and write
Use a fictional share list and three access events. Identify what each demonstrates about visibility and permission. Then state the evidence required to claim that a specific file was copied or modified. Use prepared records rather than browsing an organization's shares without authorization.
The distinction also supports proportionate remediation. A discovery event may justify reviewing visibility and role boundaries, while successful unauthorized access requires attention to actual permissions and exposure. Removing a visible share name alone does not necessarily correct the underlying access path or eliminate the business dependency.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1135: Network Share Discovery