tfMITRE ATT&CK sub-technique

Network Share Connection Removal T1070.005

sub-technique of T1070 Indicator Removal

Tactic: Stealth
Platform: Windows
Version: 2.0
Created: 31 January 2020
Last modified: 12 May 2026

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. [1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Network Share Connection Removal MITRE reference T1070.005

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Threat Group-3390G0027 ↗

Has detached network shares after exfiltrating files, likely to evade detection.1

created 2017-05-311 referenceaka Earth Smilodon

All 1 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

DUSTTRAPS1159 ↗

Can remove network shares from infected systems.1

created 2024-09-16MALWAREcarried by 1 group

RobbinHoodS0400 ↗

Disconnects all network shares from the computer with the command net use * /DELETE /Y.1

created 2019-07-29MALWARE

InvisiMoleS0260 ↗

Can disconnect previously connected remote drives.1

created 2018-10-17MALWARE

NetS0039 ↗

The net use \\system\share /delete command can be used in Net to remove an established connection to a network share.1

created 2017-05-31TOOLcarried by 33 groups

All 4 software entries for this technique

Offense vs defense T1070.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 1

first rule: 2020 Q2

Network Share Connection Removal detection strategy DET0103

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Network Share Connection Removal via CLI and SMB Disconnects

Enterprise

1 platform

AN0286 · Windows

Detects network share disconnection attempts using command-line tools like net use /delete, PowerShell Remove-SmbMapping, and correlation with process lineage and SMB session teardown activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648
Network Traffic ContentDC0085	NSM:Flow	SMB2_LOGOFF/SMB_TREE_DISCONNECT

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Adjustable window to correlate CLI disconnection command with SMB session teardown (e.g., 5 mins)
UserContext	Used to filter on non-interactive users or highly privileged accounts
ProcessCommandLineRegex	Patterns to match `net use \\host\share /delete`, `Remove-SmbMapping`, or suspicious batched disconnections
NetworkShareNamePattern	Tunable list of shares likely targeted (e.g., ADMIN$, C$, IPC$)

1 analytic

Adversaries may use network shares to exfliltrate date; they will then remove the shares to cover their tracks. This analytic looks for the removal of network shares via commandline, which is otherwise a rare event.

TypeTTPCoverageHighSubmitted2020

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
target_processes = filter processes where (
  (exe="C:\\Windows\\System32\\net.exe" AND command_line="*delete*") OR
  command_line="*Remove-SmbShare*" OR
  comman_line="*Remove-FileShare*" )
output target_processes

looks network shares being deleted from the command line

(index=__your_sysmon_index__ EventCode=1) ((Image="C:\\Windows\\System32\\net.exe" AND CommandLine="*delete*") OR CommandLine="*Remove-SmbShare*" OR CommandLine="*Remove-FileShare*")

looks network shares being deleted from the command line

norm_id=WindowsSysmon event_id=1 ((image="C:\Windows\System32\net.exe" command="*delete*") OR command="*Remove-SmbShare*" OR command="*Remove-FileShare*")

Tests5Executorscmd 4 · PowerShell 1Need elevation2 of 5Have prerequisites0Have cleanup2Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Add Network Share

windows

cmd

—

Add a Network Share utilizing the command_prompt

Input arguments

Name	Type	Default	Description
share_name	string	\\test\share	Share to add.

Attack command

net use c: #{share_name}
net share test=#{share_name} /REMARK:"test share" /CACHE:No

GUIDdaf17ad8-3ebf-43f1-a677-79f9413c30b3

Remove Network Share

windows

cmd

—

Removes a Network Share utilizing the command_prompt

Input arguments

Name	Type	Default	Description
share_name	string	\\test\share	Share to remove.

Attack command

net share #{share_name} /delete

GUIDbfef205e-b61f-42bb-8530-6a7afe5e6141

Remove Network Share PowerShell

windows

PowerShell

—

Removes a Network Share utilizing PowerShell

Input arguments

Name	Type	Default	Description
share_name	string	\\test\share	Share to remove.

Attack command

Remove-SmbShare -Name #{share_name}
Remove-FileShare -Name #{share_name}

GUIDde33ad3f-0412-4c25-aebe-9d1e6f1f024e

Disable Administrative Share Creation at Startup

windows

cmd

Required

—

Yes

Remove Administrative Shares

windows

cmd

Required

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Network Share Connection Removal detections T1070.005

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs