COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-643

Identify Shared Files/Directories on System

An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.

Soyutlama

Detailed

Tipik ciddiyet

Medium

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system).

Gerekli beceri

  • Low: Once the adversary has logical access (which can potentially require high knowledge and skill level), the adversary needs only the capability and facility to navigate the system through the OS graphical user interface or the command line. The adversary, or their malware, can simply employ a set of commands that search for shared drives on the system (e.g., net view \\remote system or net share).

Gerekli kaynak

  • None: No specialized resources are required to execute this type of attack.

Etki

Başarılı saldırı neye yol açar?

Read Data

Etkilenen alanlar: Confidentiality

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Identify unnecessary system utilities or potentially malicious software that may contain functionality to identify network share information, and audit and/or block them by using allowlist tools.