CAPEC Definitions

    CAPEC Definitions / CAPEC-643

    CAPEC-643: Identify Shared Files/Directories on System

    An adversary discovers connections between systems by exploiting the target system's standard practice of revealing them in searchable, common areas. Through the identification of shared folders/drives between systems, the adversary may further their goals of locating and collecting sensitive information/files, or map potential routes for lateral movement within the network.

    Severity:Medium
    Possibility:Medium

    Extended Description

    No Extended Description.

    Mitigations

    Identify unnecessary system utilities or potentially malicious software that may contain functionality to identify network share information, and audit and/or block them by using allowlist tools.

    Relationships with other CAPECs

    CAPEC-309: Network Topology Mapping

    CAPEC-561: Windows Admin Shares with Stolen Credentials

    CAPEC-545: Pull Data from System Resources

    CAPEC-165: File Manipulation

    Prerequisites

    The adversary must have obtained logical access to the system by some means (e.g., via obtained credentials or planting malware on the system).

    Related Weaknesses

    CWE-267: Privilege Defined With Unsafe Actions

    CWE-200: Exposure of Sensitive Information to an Unauthorized Actor