Network Share Connection Removal (MITRE ATT&CK T1070.005) is a Stealth technique on Windows.
Windows shared drive and SMB or Windows Admin Share connections can be removed when no longer needed. Adversaries remove them to clean up traces of their work.
How attackers use it
MITRE names the Net utility as an example, with the command net use \\system\share /delete. The connection that carried a file copy or remote execution then disappears from the list of active mappings on that host.
How to detect it
MITRE's detection strategy watches for share disconnection through command line tools such as net use /delete and the PowerShell cmdlet Remove-SmbMapping. It asks you to correlate that with process lineage and SMB session teardown activity.
Collect process creation with command line, and SMB session and share access logs on file servers, so you can see the other side of the connection. If a client removes a mapping and the server shows a session from that client a few minutes earlier, the pair tells the story.
How to reduce the risk
MITRE lists no mitigations. The technique abuses a normal feature. Keep command line logging on, and keep file server logs separate from the clients.
Quick check
Where does the evidence survive after a client removes a share mapping?
On the server side, in SMB session and share access logs, and in process creation logs for the command that removed it.
