从网络共享驱动器获取数据是指攻击者通过访问企业内网文件共享服务，非法提取敏感信息的数据窃取技术。攻击者通常利用合法凭证或协议漏洞，通过SMB、NFS等标准协议访问共享目录，结合命令行工具或API接口批量下载目标文件。传统防御手段主要依赖文件访问日志审计、异常权限变更监控以及网络流量内容检测等技术，通过分析账户行为异常、数据流出量突变等特征识别潜在威胁。
| 效应类型 | 是否存在 |
|---|---|
| 特征伪装 | ✅ |
| 行为透明 | ❌ |
| 数据遮蔽 | ✅ |
| 时空释痕 | ✅ |
攻击者通过精确模拟SMB/NFS协议交互过程，将数据窃取操作伪装成合规文件访问行为。采用与操作系统完全一致的API调用序列和协议状态转换，确保网络流量在协议特征、时序逻辑等方面与合法业务流不可区分，有效规避基于协议异常检测的防御系统。
在数据回传阶段采用格式保留加密、隐写术等技术对敏感内容进行混淆处理，使传输数据在保持文件格式有效性的同时丢失原始语义。结合HTTPS、SSH等加密通道传输，防御方无法通过内容检测或元数据分析识别数据泄露实质。
通过低频增量窃取技术将集中式数据迁移分解为长期持续的小规模传输，单次操作特征低于检测阈值。结合动态调整的数据分片策略与传输时间窗口选择，使泄露行为特征分散在数周乃至数月的正常业务流量中，破坏基于时间序列分析的检测模型有效性。
| ID | Name | Description |
|---|---|---|
| G0007 | APT28 | |
| S0128 | BADNEWS |
When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.[2] |
| G0060 | BRONZE BUTLER |
BRONZE BUTLER has exfiltrated files stolen from file shares.[3] |
| C0015 | C0015 |
During C0015, the threat actors collected files from network shared drives prior to network encryption.[4] |
| G0114 | Chimera |
Chimera has collected data of interest from network shares.[5] |
| S0050 | CosmicDuke |
CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.[6] |
| S0554 | Egregor |
Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.[7] |
| G0117 | Fox Kitten |
Fox Kitten has searched network shares to access sensitive documents.[8] |
| G0047 | Gamaredon Group |
Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.[9] |
| G0045 | menuPass |
menuPass has collected data from remote systems by mounting network shares with |
| S0458 | Ramsay |
Ramsay can collect data from network drives and stage it for exfiltration.[11] |
| G1039 | RedCurl | |
| G0054 | Sowbug |
Sowbug extracted Word documents from a file server on a victim network.[14] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments for actions that could be taken to collect files from a network share. Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location. Data may also be acquired and staged through Windows system management tools such as Windows Management Instrumentation and PowerShell. |
| DS0022 | File | File Access |
Monitor for unexpected files (i.e. .pdf, .docx, .jpg, etc.) interacting with network shares. |
| DS0033 | Network Share | Network Share Access |
Monitor for unexpected and abnormal accesses to network shares. |
| DS0029 | Network Traffic | Network Connection Creation |
Monitor for newly constructed network connections that may search network shares on computers they have compromised to find files of interest. Network Analysis frameworks such as Zeek can be used to capture, decode, and alert on network protocols such as SMB that revolve around network shares. |
| Network Traffic Content |
Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). |
||
| Network Traffic Flow |
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Network Analysis frameworks such as Zeek can be used to capture, decode, and alert on network protocols such as SMB that revolve around network shares. Although there may be more native ways to detect detailed SMB events on the host, they can be extracted out of network traffic. With the right protocol decoders, port 445 traffic can be filtered and even the file path (relative to the share) can be retrieved. Looking at this activity more closely to obtain an adequate sense of situational awareness may make it possible to detect adversaries moving between hosts in a way that deviates from normal activity. Because SMB traffic is heavy in many environments, this analytic may be difficult to turn into something that can be used to quickly detect an APT. In some cases, it may make more sense to run this analytic in a forensic fashion. Looking through and filtering its output after an intrusion has been discovered may be helpful in identifying the scope of compromise. |