T1070.005 Network Share Connection Removal
sub-techniqueEnterpriseAdversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command.
01
platforms
Platforms this applies to.
Windows
02
tactics
ATT&CK tactics this technique serves.
03
sub-technique of
The broader entity this sits under.
04
detected by (4)
Data components that detect this.
05
countered by (D3FEND)
D3FEND countermeasures that counter this.
06
groups (1)
Threat groups associated with this.
07
software (4)
Malware and tools associated with this.
08
Detected by (Sigma) (4)
Sigma detection rules related to this.
09
source
Where this definition is published.