Map Network Drive MRU
Overview
Section titled “Overview”Evidence: Map Network Drive MRU
Description: Enumerate Map Network Drive MRU
Category: System
Platform: windows
Short Name: mapnetmru
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Windows maintains a history of network shares that users have mapped using the “Map Network Drive” feature in Windows Explorer. This MRU list records UNC paths to network shares, providing evidence of network resource access and lateral movement.
Network share mappings can reveal access to file servers, administrative shares, and other network resources that may be relevant to data exfiltration or lateral movement investigations.
Data Collected
Section titled “Data Collected”This collector gathers structured data about map network drive mru.
Map Network Drive MRU Data
Section titled “Map Network Drive MRU Data”| Field | Description | Example |
|---|---|---|
KeyPath | Registry key path | Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU |
LastWriteTime | Registry key last write time | 2023-10-15T14:30:00 |
Value | MRU value name | a |
Username | User account name | user |
FileName | UNC path to network share | \fileserver\share\folder |
MRUPosition | Position in MRU list | 0 |
RegPath | Path to registry hive | Registry/ntuser.dat |
Collection Method
Section titled “Collection Method”This collector:
- Collects user registry hives (ntuser.dat)
- Searches for:
Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU - Parses MRUList string to determine access order
- Extracts UNC paths from registry values
- Orders by MRU position (most recent first)
Forensic Value
Section titled “Forensic Value”Mapped network drive history reveals network resource access and can indicate lateral movement. Investigators use this data to identify accessed network shares, detect lateral movement paths, track file server access, identify administrative share usage, correlate with SMB network connections, and detect data exfiltration paths.