ATT&CK · T1070.005 · sub-technique
Network Share Connection Removal
Tactics: stealth
About
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command.
Used by actors
1 known groups
Software
4 malware/tools implement this
NetInvisiMoleRobbinHoodDUSTTRAP
Corpus indicators tagged with this technique
0 indicators in the corpus carry T1070.005.
No corpus indicators are tagged with this technique yet.