CAPEC Details
Name Identify Shared Files/Directories on System
Likelyhood of attack Typical severity
Medium Medium
Summary An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.
Prerequisites The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system).
Solutions Identify unnecessary system utilities or potentially malicious software that may contain functionality to identify network share information, and audit and/or block them by using allowlist tools.
Related Weaknesses
CWE ID Description
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-267 Privilege Defined With Unsafe Actions
Related CAPECS
CAPEC ID Description
CAPEC-309 An adversary engages in scanning activities to map network nodes, hosts, devices, and routes. Adversaries usually perform this type of network reconnaissance during the early stages of attack against an external network. Many types of scanning utilities are typically employed, including ICMP tools, network mappers, port scanners, and route testing utilities such as traceroute.
Taxonomy: ATTACK
Entry ID Entry Name
1135 Network Share Discovery