Dark Mode
Capec-643 Detail
Identify Shared Files/Directories on System
Detailed Software Likelihood: Medium Typical Severity: Medium
Parents: 309
Threats: T60 T65 T80 T258 T288 T291 T302 T334 T392 T407
An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.
Not present
| External ID | Source | Link | Description |
|---|---|---|---|
| CAPEC-643 | capec | https://capec.mitre.org/data/definitions/643.html | |
| CWE-267 | cwe | http://cwe.mitre.org/data/definitions/267.html | |
| CWE-200 | cwe | http://cwe.mitre.org/data/definitions/200.html | |
| T1135 | ATTACK | https://attack.mitre.org/wiki/Technique/T1135 | Network Share Discovery |
Not present
- The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system).
- None: No specialized resources are required to execute this type of attack.
| Low |
|---|
| Once the adversary has logical access (which can potentially require high knowledge and skill level), the adversary needs only the capability and facility to navigate the system through the OS graphical user interface or the command line. The adversary, or their malware, can simply employ a set of commands that search for shared drives on the system (e.g., net view \\remote system or net share). |
| Confidentiality |
|---|
| Read Data (The adversary is potentially able to identify the location of sensitive information or lateral pathways through the network.) |
Not present