Sharelock

Elementary file-share triage, powered by ripgrep.

Sharelock is an early-stage PowerShell operator tool for finding potentially sensitive files and text on Windows SMB shares during authorized red-team and internal-security engagements.

It combines fast filename inventory with ripgrep content searches and Snaffler-inspired prioritization. It can inspect one known share containing a large number of files or work across a bounded list of hosts, shares, or IPv4 targets.

Important

This is not a finished product or a replacement for operator judgment. Rule coverage, performance, and false-positive behavior still need validation across varied environments.

What it does

Sharelock performs two independent passes:

1. Artifact inventory uses rg --files to identify interesting filenames, extensions, and paths, including private keys, credential stores, configuration files, packet captures, and English/Italian document names.
2. Content scanning uses PCRE2 expressions for likely passwords, tokens, private-key material, connection strings, and other secret-bearing assignments. Matches are scored, allowlisted, and redacted before output.

Raw content is redacted by default. Office and OpenDocument containers are filename-triaged but not content-scanned.

Requirements

• Windows PowerShell 5.1 or newer.
• Windows x86-64.
• ripgrep, installed locally, available on PATH, or supplied with -RgPath.
• Authorized access to each target share through the current logon token or an explicitly supplied PSCredential.
• Network and endpoint impact permitted by the applicable rules of engagement.

The source repository does not contain rg.exe, and Sharelock never downloads or installs dependencies.

Install ripgrep

Install ripgrep using a package manager:

winget install BurntSushi.ripgrep.MSVC
# or
scoop install ripgrep
# or
choco install ripgrep

You can also download a Windows build from the official ripgrep releases. Sharelock accepts an explicit executable path:

.\Invoke-Sharelock.ps1 `
  -RgPath C:\Tools\ripgrep\rg.exe `
  -Target '\\fileserver.corp.example\Engineering'

Dependency resolution follows this order:

1. Explicit -RgPath.
2. rg.exe beside the scanner, as used by a manually assembled offline package.
3. .tools\ripgrep\rg.exe, when placed there manually for local development.
4. rg.exe available through PATH.

For an offline engagement, obtain ripgrep beforehand and copy it beside Invoke-Sharelock.ps1, under .tools\ripgrep\, or elsewhere with -RgPath. Preserve ripgrep's upstream license files when redistributing its executable.

If ripgrep cannot be found, Sharelock stops before scanning and prints these installation options and the official release URL.

Quick start

Validate the resolved executable and rule files:

.\Invoke-Sharelock.ps1 -SelfTest

Show built-in help:

.\Invoke-Sharelock.ps1 -Help

Scan a known share with balanced filename and content checks:

.\Invoke-Sharelock.ps1 `
  -Target '\\fileserver.corp.example\Engineering' `
  -OutputFile .\engineering-findings.jsonl

The .jsonl extension selects JSON Lines output automatically. Use .csv for streaming CSV output.

Scan profiles

Profile	Inventory	Content	Intended use
Triage	Yes	No	Fast filename, extension, and path review
Balanced	Yes	Yes	Default focused-share workflow
Content	No	Yes	Regex-only searches where filenames are not needed
Deep	Yes	Yes	Greater default depth and file-size allowance

Explicit -MaxDepth, -MaxFileSizeMB, -NoInventory, and -NoContent options can refine these profiles.

Focused share workflows

Fast artifact discovery without reading file contents:

.\Invoke-Sharelock.ps1 `
  -Target '\\fileserver.corp.example\Finance' `
  -ScanProfile Triage `
  -MaxDepth 12

Content-only scan with engagement-specific exclusions:

.\Invoke-Sharelock.ps1 `
  -Target '\\fileserver.corp.example\Development' `
  -ScanProfile Content `
  -ExcludeGlob '*.min.js','**/vendor/**' `
  -OutputFile .\development.jsonl

Restrict the scan to selected file patterns:

.\Invoke-Sharelock.ps1 `
  -Target '\\fileserver.corp.example\Applications' `
  -IncludeGlob '*.config','*.env','*.yml' `
  -MaxDepth 8

Broad enumeration workflows

Scan a prepared target list against one share:

.\Invoke-Sharelock.ps1 `
  -TargetFile .\targets.txt `
  -Share C$ `
  -ScanProfile Triage `
  -DelayMs 250 `
  -OutputFile .\triage.jsonl

Scan a bounded IPv4 range:

.\Invoke-Sharelock.ps1 `
  -CIDR 192.0.2.0/24 `
  -Share C$ `
  -MaxCidrHosts 256 `
  -TimeoutSeconds 120 `
  -OutputFile .\range.csv

Enumerate disk shares from a hostname instead of selecting one:

.\Invoke-Sharelock.ps1 `
  -Target fileserver.corp.example `
  -EnumShares `
  -ScanProfile Triage

Share discovery uses the language-independent Windows NetShareEnum API. -NoPing skips the preliminary TCP/445 reachability check when SMB access is expected despite probe failure.

Large CIDRs are rejected before expansion unless the operator deliberately supplies -AllowLargeCidr. Host scanning remains sequential in this early version; -DelayMs provides simple pacing between targets.

Credentials

By default, Sharelock uses the current Windows security context. To use an explicit credential:

$credential = Get-Credential
.\Invoke-Sharelock.ps1 `
  -Target '\\fileserver.corp.example\Restricted' `
  -Credential $credential

Windows does not allow simultaneous SMB connections to the same host under different identities. Sharelock reports Windows error 1219 when it recognizes that conflict; disconnect the existing session or reuse its identity before retrying.

Output and redaction

Console and file output are streamed as findings are discovered. Each result includes:

• ScanId and RuleId
• severity and score
• host and file path
• line number for content matches
• rule hint and entropy
• redacted matched content
• source and timestamp

Example default output:

[RED:075] \\fileserver.corp.example\Engineering\deployment.env:18 (SecretAssignment, H=4.12) - client_secret = "[REDACTED:32]"
[RED:075] \\fileserver.corp.example\Finance\credenziali_produzione.xlsx (Filename) - Interesting English/Italian Office document name (content not scanned)

Useful output controls:

# Omit matched lines completely while retaining content-derived paths.
.\Invoke-Sharelock.ps1 -Target '\\host\share' -PathsOnly

# Explicitly include raw matches. Protect console transcripts and output files.
.\Invoke-Sharelock.ps1 -Target '\\host\share' -ShowSecrets

# Replace an existing output file deliberately.
.\Invoke-Sharelock.ps1 -Target '\\host\share' -OutputFile .\findings.jsonl -ForceOutput

English and Italian indicators

The default rules recognize common English and Italian credential terminology in filenames and content, including variants of:

• password, credential, secret, account, login, token, and key
• password document names and configuration assignments
• credenziali, credenziale, segreto, segreti, utenza, utente, utenze, accesso, accessi, chiave, and access-code terminology

Language-dependent contributions should include synthetic positive and negative fixtures for both relevant environments.

Rule structure

rules/default-rules.psd1 contains exact filenames, extensions, discard paths, allowlists, and English/Italian Office-document name indicators. patterns.clean.txt contains the primary PCRE2 content expressions, while patterns.snaffler.txt contains supplemental Snaffler-inspired expressions.

Ripgrep emits structured JSON match events. Sharelock then applies allowlisting, entropy measurement, scoring, and redaction. Severity is prioritization for operator review, not proof that a credential is valid.

Allowlisting

Copy allowlist.example.txt to an engagement-local file that remains outside Git:

Copy-Item .\allowlist.example.txt .\allowlist.txt
.\Invoke-Sharelock.ps1 `
  -Target '\\host\share' `
  -AllowlistFile .\allowlist.txt

Each non-empty, non-comment line is treated as a regex and matched against both the path and matched content. Broad allowlists can hide genuine findings.

Network and file-read behavior

Sharelock does not copy every target file into a local collection directory. Ripgrep opens matching file types through SMB and streams their contents while searching.

This distinction matters:

• It avoids creating a complete local copy before scanning.
• It is not server-side search.
• File bytes still cross the network and may be read in full when a search reaches end-of-file.
• Filename-only triage reads directory metadata; selected certificate/key containers may have only their first 4 KB inspected for a private-key marker.

Choose depth, file-size limits, profiles, pacing, and target scope according to the engagement's stability and operational-security requirements.

Known limitations

• Office, OpenDocument, PDF, archive, database, and encrypted password-store contents are not extracted.
• Binary or compressed artifacts are generally filename/extension findings only.
• Share enumeration is limited by the current identity and remote Windows behavior.
• Content matching is heuristic and requires operator review.
• A finding does not prove that a credential is valid, current, or reusable.
• Host and share scanning are currently sequential.
• Interrupted-scan resume is not implemented yet.
• Explicit-credential behavior should be validated in the operator's Windows/domain lab before engagement use.

Repository layout

Invoke-Sharelock.ps1                    Main operator script
rules/default-rules.psd1               Filename, extension, path, and allowlist data
patterns.clean.txt                     Primary PCRE2 content expressions
patterns.snaffler.txt                  Supplemental Snaffler-inspired expressions
allowlist.example.txt                  Engagement-local allowlist template
tests/                                 Synthetic English/Italian integration tests
.tools/ripgrep/                        Optional ignored location for a manually supplied rg.exe

The local Snaffler/ checkout and engagement outputs are excluded through .gitignore and are not part of the intended repository contents.

Testing

Run the built-in pattern checks:

.\Invoke-Sharelock.ps1 -SelfTest

Run the Pester integration suite:

Invoke-Pester .\tests\Sharelock.Tests.ps1

Contributors should execute both checks locally before committing changes.

Project status and roadmap

Sharelock is pre-release software. Near-term work is expected to focus on:

• validation against representative English and Italian Windows/domain labs
• rule-quality measurement and false-positive reduction
• bounded host concurrency
• resumable broad scans
• clearer rule metadata and targeted custom rule packs

Archive extraction, automatic credential validation, file collection, GUI work, and distributed scanning are deliberately outside the current scope.

Authorization and data handling

Use Sharelock only where you have explicit authorization. Raw matches and even filenames can contain sensitive information. Follow the rules of engagement for collection, storage, transmission, reporting, retention, and destruction of results.

Use -ShowSecrets only when the rules of engagement require raw values. Security reports should use GitHub's private vulnerability-reporting feature and must contain synthetic reproduction data rather than customer information.

Contributing

Keep changes compatible with Windows PowerShell 5.1 and preserve redaction as the default. Never submit customer names, hostnames, paths, credentials, tokens, or engagement output.

Rules that depend on human language should consider both English and Italian terminology. New classifiers should include synthetic positive and negative examples and document likely false positives or additional network-read impact.

Contributions are accepted under GPL-3.0-only.

Credits and license

Sharelock uses ripgrep, which is dual-licensed under MIT or the Unlicense, for high-performance file listing and content search. Its classifications and supplemental patterns are inspired by and adapted from GPLv3-licensed Snaffler.

Sharelock is licensed under GPL-3.0-only. When packaging ripgrep with Sharelock for offline use, retain ripgrep's COPYING, LICENSE-MIT, and UNLICENSE files.