CAPEC-643: Identify Shared Files/Directories on System
CAPEC版本: 3.9
更新日期: 2023-01-24
攻击模式描述
An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.
前提条件
- The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system).
所需技能
所需资源
- None: No specialized resources are required to execute this type of attack.
后果影响
影响范围: Confidentiality
技术影响: Read Data
说明: The adversary is potentially able to identify the location of sensitive information or lateral pathways through the network.
缓解措施
Identify unnecessary system utilities or potentially malicious software that may contain functionality to identify network share information, and audit and/or block them by using allowlist tools.
分类映射
| 分类名称 | 条目ID | 条目名称 |
|---|---|---|
| ATTACK | 1135 | Network Share Discovery |