MITRE ATT&CK technique

Data from Network Shared Drive detection rulesT1039

Data from Network Shared Drive (T1039) is a MITRE ATT&CK technique in the Collection tactic. This page lists the 2 community-maintained Sigma detection rules in the library mapped to T1039 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.

T1039 on attack.mitre.org2 rules

Tactic

Collection

Copy From Or To Admin Share Or Sysvol Folder
medium
Detects a copy command or a copy utility execution to or from an Admin share or remote
windows · process_creation
Suspicious Access to Sensitive File Extensions
medium
Detects known sensitive file extensions accessed on a network share
windows

Top products

Tactic

Copy From Or To Admin Share Or Sysvol Folder

Suspicious Access to Sensitive File Extensions