Indicator Removal: Network Share Connection Removal

Created the Tuesday 07 February 2023. Updated 1 year, 2 months ago.

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \system\share /delete command.

Technique Identifier

T1070.005

Technique Tags

Defense Evasion net use \system\share /delete SMB share disconnect network shares

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Indicator Removal: Network Share Connection Removal, Sub-technique T1070.005 - Enterprise | MITRE ATT&CK®