> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/windows/forensics/network-share.md).

# Network Share

## Registry:

### <mark style="color:blue;">Hard Evidence of Network Share Presence:</mark>

#### **Mapped network drive Most-Recently Used (MRU) items**

* HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Map
* HKEY\_USERS\\\<SID>\Microsoft\Windows\CurrentVersion\Explorer\Map

#### &#x20;**Network Drive MRU • Mapped network drives (Network Drive Wizard)**

* HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
* HKEY\_USERS\\\<SID>\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

#### Currently Mapped Shares

* HKCU\\\<SID>\Network\\\<Drive Letter>
* HKEY\_USERS\\\<SID>\Network\\\<Drive Letter>

#### **All open shares on a system**&#x20;

* HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares

#### User connected to specific machines on LAN

* HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComputerDescriptions
* HKEY\_USERS\\\<SID>\Microsoft\Windows\CurrentVersion\Explorer\ComputerDescriptions

{% hint style="info" %}
These entries consist of hard evidence that the network share is mapped to this computer.
{% endhint %}

### <mark style="color:yellow;">Soft Evidence of Network Share (share reference):</mark>

**Items typed into the Windows Run dialog by the user**&#x20;

* HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
* HKEY\_USERS\\\<SID>\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

**Words typed into the Windows Explorer**

* HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
* HKEY\_USERS\\\<SID>\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths

#### Shellbags:

#### NTUSER.DAT

* NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU
* NTUSER.DAT\Software\Microsoft\Windows\Shell\Bags

#### USRCLASS.DAT

* USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
* USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\Bags

{% hint style="warning" %}
These can be leveraged to show the existence or reference of network shares that the TA attempted to navigate to on the host. Consists of references to the shares by typed keywords from the TA or navigated to directories.&#x20;
{% endhint %}

## UAL:

Leverage UALs located on DCs to map SMB traffic from a specific user to machines on the domain.

<table data-header-hidden><thead><tr><th width="281"></th><th></th><th></th><th width="124"></th><th></th></tr></thead><tbody><tr><td><strong>RoleGuid</strong></td><td><strong>TotalAccesses</strong></td><td><strong>InsertDate</strong></td><td><strong>LastAccess</strong></td><td><strong>AuthenticatedUserName</strong></td></tr><tr><td>10a9226f-50ee-49d8-a393-9a501d47ce04</td><td>1</td><td>2019-03-12T18:06:56Z</td><td>2019-03-12T18:06:56Z</td><td>DOMAIN\User1</td></tr></tbody></table>

{% embed url="<https://www.crowdstrike.com/blog/user-access-logging-ual-overview/>" %}

## Event Logs

### Default Logging - Source Host

* 4648: A logon was attempted using explicit credentials.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2FCgsyb18GiEzcdOL7rMTu%2Fimage.png?alt=media&amp;token=bc4ad438-572d-49b5-9939-6a19d81a60ed" alt=""><figcaption></figcaption></figure>

### Default Logging - Destination Host

Below 3 event IDs should all happen simultaneously.

* 4776 — The computer attempted to validate the credentials for an account
* 4672 — Special privileges assigned to new logon
* 4624 (Type 3) — An account was successfully logged on

{% embed url="<https://imphash.medium.com/detecting-lateral-movement-101-tracking-movement-smb-windows-admin-shares-through-windows-log-6005e3ba6980>" %}

### Advanced Logging

While Event IDs 5140 and 5145 are useful, they are merely a part of the “Object Access” audit category in Active Directory. You can use auditpol.exe to enable all events within the Object Access category, as such:&#x20;

```powershell
auditpol /set /category:"Object Access" /success:enable
```

* 5140(S, F): A network share object was accessed.
* 5142(S): A network share object was added.&#x20;
* 5143(S): A network share object was modified.&#x20;
* 5144(S): A network share object was deleted.&#x20;
* 5145(S): A network share object was checked to see whether client can be granted desired access (Synchronize, ReadData, ListDirectory, ReadAttribute).&#x20;
* 5168(F): SPN check for SMB/SMB2 failed

## Live Triage:

### Net Share:

* Can be used to show shares being hosted by the host.

```
C:\Users\user>net share

Share name   Resource                        Remark

-------------------------------------------------------------------------------
C$           C:\                             Default share
E$           E:\                             Default share
F$           F:\                             Default share
H$           H:\                             Default share
I$           I:\                             Default share
IPC$                                         Remote IPC
ADMIN$       C:\WINDOWS                      Remote Admin
```

### Net Use:

* Display shares that the host has connected/mapped to.

<figure><img src="https://3278866189-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fu4e057u3LTRKJEHFetwE%2Fuploads%2F1bw8Nv5gswqzKOlcuxUi%2Fimage.png?alt=media&amp;token=8d39a557-8535-4329-999a-d965c4e9e805" alt=""><figcaption></figcaption></figure>