Data from Network Shared Drive
Technique · ATTACK:enterprise:T1039
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1039",
"title": "Data from Network Shared Drive",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1039",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--ae676644-d2d2-41b7-af7e-9bed1b55898c",
"external_id": "T1039",
"domain": "enterprise",
"created": "2017-05-31T21:30:41.022Z",
"modified": "2026-09-02T18:26:02.395Z",
"version": "1.6",
"aliases": [
],
"tactics": [
"collection"
],
"source_references": [
{
"source_name": "Net Use",
"url": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/gg651155(v=ws.11)"
},
{
"source_name": "Cybersecurity Advisory GRU Brute Force Campaign July 2021",
"url": "https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fe3ccfb-2ed1-412f-af7e-c63821a5e434
group-ib_redcurl1 · group-ib_redcurl2ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e7c9978-4db1-4ee1-ae27-640acee5a543
F-Secure CosmicdukeATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41fd6ebb-4262-40f8-842e-ff583ff01500
Cybersecurity Advisory GRU Brute Force Campaign July 2021ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4716b9ec-a0d4-47db-a901-5a3b67d9e096
ESET Gamaredon June 2020 · ESET Gamaredon Sept2024ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--595be2e7-9f2a-4d5a-b23d-8e4822ae6199
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59c58c73-046c-4e01-9ced-8c049381fcd2
NHS Digital Egregor Nov 2020ATTACK:enterprise:G0054 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f3eb1ae-782e-4e49-8e1e-650f3e5a1139
Symantec Sowbug Nov 2017ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c692a16-22b8-42bb-9a6b-3c25a2714cf5
Eset Ramsay May 2020ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c9649b7-00c6-4503-a911-9e8b9086eac4
Forcepoint MonsoonATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78a5ebb3-2506-492e-8b50-83199b2510f1
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--acb0fd33-201c-481f-857d-429c3ef67015
NCC Group Chimera January 2021ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2909563-2b7e-48d6-b165-05b8eff63862
PWC Cloud Hopper April 2017ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3720380-6d0d-41a9-a2b5-e0fcc311f486
DFIR Conti Bazar Nov 2021ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d51c9d02-a701-4334-9dbc-bba6c128ba2b
CISA AA20-259A Iran-Based Actor September 2020