Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Technique Network Share Connection Removal
RU
Риски
Каталоги
MITRE ATT&CK
Техника
Network Share Connection Remov...
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Indicator Removal:  Network Share Connection Removal

ID Name
.001 Clear Windows Event Logs
.002 Clear Linux or Mac System Logs
.003 Clear Command History
.004 File Deletion
.005 Network Share Connection Removal
.006 Timestomp
.007 Clear Network Connection History and Configurations
.008 Clear Mailbox Data
.009 Clear Persistence
.010 Relocate Malware

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. (Citation: Technet Net Use)

ID: T1070.005
Sub-technique of:  T1070
Tactic(s): Defense Evasion
Platforms: Windows
Data Sources: Command: Command Execution, Network Traffic: Network Traffic Content, Process: Process Creation, User Account: User Account Authentication
Version: 1.2
Created: 31 Jan 2020
Last Modified: 16 Apr 2025

Procedure Examples
Name Description
Net

The net use \\system\share /delete command can be used in Net to remove an established connection to a network share.(Citation: Technet Net Use)
RobbinHood

RobbinHood disconnects all network shares from the computer with the command net use * /DELETE /Y.(Citation: CarbonBlack RobbinHood May 2019)
DUSTTRAP

DUSTTRAP can remove network shares from infected systems.(Citation: Google Cloud APT41 2024)
InvisiMole

InvisiMole can disconnect previously connected remote drives.(Citation: ESET InvisiMole June 2018)
Threat Group-3390

Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.(Citation: SecureWorks BRONZE UNION June 2017)

Mitigations
Mitigation Description
Network Share Connection Removal Mitigation

Follow best practices for mitigation of activity related to establishing Windows Admin Shares. Identify unnecessary system utilities or potentially malicious software that may be used to leverage network shares, and audit and/or block them by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Detection

Network share connections may be common depending on how an network environment is used. Monitor command-line invocation of net use commands associated with establishing and removing remote shares over SMB, including following best practices for detection of Windows Admin Shares. SMB traffic between systems may also be captured and decoded to look for related network share session and file transfer activity. Windows authentication logs are also useful in determining when authenticated network shares are established and by which account, and can be used to correlate network share activity to other events to investigate potentially malicious activity.

References

  1. Microsoft. (n.d.). Net Use. Retrieved November 25, 2016.
  2. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
  3. Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.
  4. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.
  5. Lee, S. (2019, May 17). CB TAU Threat Intelligence Notification: RobbinHood Ransomware Stops 181 Windows Services Before Encryption. Retrieved July 29, 2019.
Навигация

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.