T1070.005sub-technique of T1070 Indicator Removal

Network Share Connection Removal

Windowsnothing on this site yetT1070.005 on attack.mitre.org

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the `net use \\system\share /delete` command.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Behavioral Detection of Network Share Connection Removal via CLI and SMB Disconnects

Detects network share disconnection attempts using command-line tools like `net use /delete`, PowerShell `Remove-SmbMapping`, and correlation with process lineage and SMB session teardown activity.

the rest of T1070

T1070.003 Clear Command History · not covered yet
T1070.004 File Deletion · 6 on this site
T1070.006 Timestomp · 3 on this site
T1070.007 Clear Network Connection History and Configurations · not covered yet
T1070.008 Clear Mailbox Data · not covered yet
T1070.009 Clear Persistence · not covered yet
T1070.010 Relocate Malware · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.