CmdID

CmdID / Techniques / T1070

T1070.005 Indicator Removal: Network Share Connection Removal

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. MITRE ATT&CK

1 Sigma rule T1070.005 on attack.mitre.org

Part of

MITRE ATT&CK

T1070Indicator Removal

Sigma rules tagged with it

process creation, the highest levels first

lowUnmount Share Via Net.EXEoscd.community, @redcanary, Zach Stanford @svch0st · Windows