T1070.005: Network Share Connection Removal

MITRE ATT&CK® Enterprise technique

Description

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the <code>net use \system\share /delete</code> command. (Citation: Technet Net Use)

Detection

(no detection guidance published)

Data sources

• (none listed)

References

• ATT&CK page: https://attack.mitre.org/techniques/T1070/005
• ATT&CK Enterprise matrix: https://attack.mitre.org/matrices/enterprise/