Detection of Network File Share Discovery via PowerView

This threat brief details the detection of the 'Invoke-ShareFinder' cmdlet, a component of the PowerView framework commonly used by threat actors for internal network reconnaissance. PowerView is a PowerShell-based toolset designed to facilitate the discovery and enumeration of Active Directory environments. By executing 'Invoke-ShareFinder', an attacker can map accessible network file shares across an organization's environment. This discovery process is a critical pre-cursor to lateral movement and data exfiltration, as it allows adversaries to identify targets containing backups, sensitive documentation, hardcoded credentials, or automation scripts. Defenders must monitor PowerShell execution patterns to identify the use of such enumeration tools, particularly when executed by non-administrative users or from workstations where such activity is anomalous.

Impact

Successful reconnaissance via 'Invoke-ShareFinder' significantly lowers the barrier for attackers to identify and access high-value targets within a network. Organizations are at risk of unauthorized access to proprietary data, intellectual property, and credential theft, which can subsequently lead to broader network compromise, ransomware deployment, or long-term persistence within the target environment.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) across all organizational endpoints to ensure visibility into script execution.
• Deploy the Sigma rule below to detect and alert on the usage of PowerView's share discovery functionality.
• Baseline the usage of administrative PowerShell frameworks to identify and whitelist legitimate operational requirements, reducing noise for SOC analysts.