T1070.005 Network Share Connection Removal Mappings

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the <code>net use \system\share /delete</code> command. (Citation: Technet Net Use)



Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
action.malware.variety.Destroy data Destroy or corrupt stored data related-to T1070.005 Indicator Removal on Host: Network Share Connection Removal
amazon_inspector Amazon Inspector technique_scores T1070.005 Network Share Connection Removal