Skip to content

Hide Navigation Hide TOC

Network Share Connection Removal - T1126 (e7eab98d-ae11-4491-bd28-a53ba875865a)

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \system\share /delete command. (Citation: Technet Net Use)

Cluster A Galaxy A Cluster B Galaxy B Level
Network Share Connection Removal - T1126 (e7eab98d-ae11-4491-bd28-a53ba875865a) Attack Pattern Network Share Connection Removal - T1070.005 (a750a9f6-0bde-4bb3-9aae-1e2786e9780c) Attack Pattern 1
Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69) Attack Pattern Network Share Connection Removal - T1070.005 (a750a9f6-0bde-4bb3-9aae-1e2786e9780c) Attack Pattern 2