Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. (Citation: Technet Net Use)

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is blocked by Behavioral Detection of Network Share Connection Removal via CLI and SMB Disconnects
Impressum Deutsch Englisch