Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \system\share /delete command. [1]
| ID | Name | Description |
|---|---|---|
| S1159 | DUSTTRAP |
DUSTTRAP can remove network shares from infected systems.[2] |
| S0260 | InvisiMole |
InvisiMole can disconnect previously connected remote drives.[3] |
| S0039 | Net |
The |
| S0400 | RobbinHood |
RobbinHood disconnects all network shares from the computer with the command |
| G0027 | Threat Group-3390 |
Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.[5] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0103 | Behavioral Detection of Network Share Connection Removal via CLI and SMB Disconnects | AN0286 |
Detects network share disconnection attempts using command-line tools like |