MITRE ATT&CKsub-technique

T1070.005 Network Share Connection Removal

Published 2020-01-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Windows
Version
2.0
Created
2020-01-31

Description

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \\system\share /delete command.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1070 Indicator Removal technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (5)

  • S1159 DUSTTRAP software (malware)
  • S0400 RobbinHood software (malware)
  • S0260 InvisiMole software (malware)
  • G0027 Threat Group-3390 group
  • S0039 Net software (tool)

References