T1070.005 — Network Share Connection Removal
Tactic: Stealth · Platforms: Windows
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with…
Sub-technique of Indicator Removal (T1070).
Sigma detection rules (1)
T1070.005 Indicator Removal: Network Share Connection Removal
title: "T1070.005 Indicator Removal: Network Share Connection Removal"
id: f22ec884-a4e7-4f99-bd83-d70cb970293c
description: 'Detects net.exe/net1.exe command-line invocations containing both "use" and "delete", indicating removal of an SMB/Windows Admin Share connection to erase traces of lateral movement. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, ProcessCommandLineRegex, NetworkShareNamePattern.'
references:
- https://attack.mitre.org/techniques/T1070/005
author: Shahrukh Khan
date: 2026-01-07
license: MIT
tags:
- attack.stealth
- attack.t1070.005
logsource:
category: process_creation
product: windows
detection:
selection_image:
Image|endswith:
- '\net.exe'
- '\net1.exe'
selection_cli:
CommandLine|contains|all:
- 'use'
- 'delete'
filter_system_account:
User|contains:
- 'SYSTEM'
- 'LOCAL SERVICE'
- 'NETWORK SERVICE'
condition: selection_image and selection_cli and not filter_system_account
falsepositives:
- Legitimate administrative scripts or logoff routines that clean up mapped drives.
level: medium
Related sub-techniques
Explore