FORENSIA

ATT&CK · T1070.005 · sub-technique

Network Share Connection Removal

Tactics: stealth

About

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command.

Platforms: WindowsParent: T1070 Indicator RemovalMITRE ATT&CK ↗

Used by actors

1 known groups

Software

4 malware/tools implement this

NetInvisiMoleRobbinHoodDUSTTRAP

Corpus indicators tagged with this technique

0 indicators in the corpus carry T1070.005.

No corpus indicators are tagged with this technique yet.