Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
ATT&CK knowledge
Loading the current evidence view. Navigation and account controls remain available.
Tactics: collection
8
known groups
4
software
34
corpus matches
about
Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within cmd may be used to gather information.
used by actors
8 known groups
corpus indicators tagged T1039
34 carry this technique
A shared-technique signal for hunting: each row resolves to its own verdict. Not attribution to any one group.
software
4 malware & tools implement this
showing top 30 by severity of 34