MITRE ATT&CK Technique
Collection
T1039
Description
Adversaries may search network shares on computers they have compromised to find files of interest. Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to Exfiltration. Interactive command shells may be in use, and common functionality within [cmd](https://attack.mitre.org/software/S0106) may be used to gather information.
Supported Platforms
Linux
macOS
Windows
Created
April 29, 2026
Last Updated
April 29, 2026
STIX Data
{'created': '2017-05-31T21:30:41.022Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': 'Adversaries may search network shares on computers they have '
'compromised to find files of interest. Sensitive data can be '
'collected from remote systems via shared network drives (host '
'shared directory, network file server, etc.) that are '
'accessible from the current system prior to Exfiltration. '
'Interactive command shells may be in use, and common '
'functionality within '
'[cmd](https://attack.mitre.org/software/S0106) may be used to '
'gather information.',
'external_references': [{'external_id': 'T1039',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/techniques/T1039'}],
'id': 'attack-pattern--ae676644-d2d2-41b7-af7e-9bed1b55898c',
'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
'phase_name': 'collection'}],
'modified': '2025-10-24T17:49:13.555Z',
'name': 'Data from Network Shared Drive',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'attack-pattern',
'x_mitre_attack_spec_version': '3.2.0',
'x_mitre_contributors': ['David Tayouri'],
'x_mitre_deprecated': False,
'x_mitre_detection': '',
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_is_subtechnique': False,
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_platforms': ['Linux', 'macOS', 'Windows'],
'x_mitre_version': '1.5'}