Indicator Removal: Network Share Connection Removal (T1070.005)

Tactic: Stealth · Platforms: Windows

The interactive view maps 1 detection strategy, 1 threat group, 4 software entries to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Indicator Removal (T1070).

Overview

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \\system\share /delete command.

Explore

• Open T1070.005 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1070.005
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan