← Back to Explore
T1070.005
Network Share Connection Removal
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)
Windows
6
Detections
3
Sources
1
Threat Actors
BY SOURCE
4sigma1crowdstrike_cql1splunk_escu
PROCEDURES (4)
Process Creation Monitoring2 detections
Auto-extracted: 2 detections for process creation monitoring
Registry Monitoring2 detections
Auto-extracted: 2 detections for registry monitoring
Network Connection Monitoring1 detections
Auto-extracted: 1 detections for network connection monitoring
Command Line Monitoring1 detections
Auto-extracted: 1 detections for command line monitoring