33 lines
1.9 KiB
JSON
33 lines
1.9 KiB
JSON
|
{
|
||
|
|
"id": "bundle--a87938c5-cc1e-4e06-a8a3-b10243ae397d",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"created": "2017-05-31T21:30:41.022897Z",
|
||
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
||
|
|
"description": "Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, etc.) that are accessible from the current system prior to cmd may be used to gather information.\n\nDetection: Monitor processes and command-line arguments for actions that could be taken to collect files from a network share. Remote access tools with built-in features may interact directly with the Windows API to gather data. Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.\n\nPlatforms: Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP, Windows 7, Windows 8, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2012 R2, Windows Vista, Windows 8.1\n\nData Sources: File monitoring, Process monitoring, Process command-line parameters",
|
||
|
|
"external_references": [
|
||
|
|
{
|
||
|
|
"external_id": "T1039",
|
||
|
|
"source_name": "mitre-attack",
|
||
|
|
"url": "https://attack.mitre.org/wiki/Technique/T1039"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"id": "attack-pattern--ae676644-d2d2-41b7-af7e-9bed1b55898c",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "mitre-attack",
|
||
|
|
"phase_name": "collection"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"modified": "2017-05-31T21:30:41.022897Z",
|
||
|
|
"name": "Data from Network Shared Drive",
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
||
|
|
],
|
||
|
|
"type": "attack-pattern"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"spec_version": "2.0",
|
||
|
|
"type": "bundle"
|
||
|
|
}
|