Indicator Removal: Network Share Connection Removal
- ID
- T1070.005
- Tactics
- TA0005 Stealth
- Sub-technique of
- T1070 Indicator Removal
- Platforms
- Windows
- Data sources
- Logon Session Creation, Process Creation, Command Execution, Network Traffic Content
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. [1]
Detection
- DET0103 Behavioral Detection of Network Share Connection Removal via CLI and SMB Disconnects
Data components: Logon Session Creation, Process Creation, Command Execution, Network Traffic Content