Cross-source coverage

T1070.005 / ATT&CK

Indicator Removal: Network Share Connection Removal

5 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \\system\share /delete command.

Tactics
Stealth
Platforms
Windows
Telemetry
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:PowerShellNSM:Flow

How MITRE says to detect it DET0103

Behavioral Detection of Network Share Connection Removal via CLI and SMB Disconnects

Windows Analytic 0286

Detects network share disconnection attempts using command-line tools like `net use /delete`, PowerShell `Remove-SmbMapping`, and correlation with process lineage and SMB session teardown activity.

  • WinEventLog:Security EventCode=4624, 4648
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
  • NSM:Flow SMB2_LOGOFF/SMB_TREE_DISCONNECT

View on attack.mitre.org ↗

SigmaHQ/sigma

4 rules
Detection Severity Format
Disable Administrative Share Creation at Startup Medium Sigma
PowerShell Deleted Mounted Share Medium Sigma
MaxMpxCt Registry Value Changed Low Sigma
Unmount Share Via Net.EXE Low Sigma

splunk/security_content

1 rule
Detection Severity Format
Create or delete windows shares using net exe Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.