T1070.005Stealth
Network Share Connection Removal
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \\system\share /delete command.
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
4 Sigma rules tagged T1070.005Network Share Connection RemovalT1070.0054 general rules
- Disable Administrative Share Creation at Startupmediumtest
- PowerShell Deleted Mounted Sharemediumtest
- MaxMpxCt Registry Value Changedlowtest
- Unmount Share Via Net.EXElowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Network Share Connection Removal
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.