T1070.005 — Indicator Removal: Network Share Connection Removal
Sub-technique of T1070 Indicator Removal
Description
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \\system\share /delete command.
Detected by EasySIEM
This project's own SigmaHQ-derived detection pipeline tags every compiled rule with the ATT&CK technique(s) it maps to -- if a rule in your install covers this technique, its alerts show up automatically on your own EasySIEM Console's ATT&CK Reference page, no lookup needed. This page exists so a click from there always lands here on easysiem.com, not on attack.mitre.org.