Network Share Connection Removal

Hypothesis and description

Adversaries may use network shares to exfliltrate date; they will then remove the shares to cover their tracks. This analytic looks for the removal of network shares via commandline, which is otherwise a rare event.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-11-30
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1070 Indicator RemovalT1070.005	Stealth (formerly Defense Evasion)	High

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1070Indicator Removal
.005 Network Share Connection Removal

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - network shares being removed via the command lineData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
target_processes = filter processes where (
  (exe="C:\\Windows\\System32\\net.exe" AND command_line="*delete*") OR
  command_line="*Remove-SmbShare*" OR
  comman_line="*Remove-FileShare*" )
output target_processes

SplunkSplunk Search - delete network sharesData model: Sysmon native

looks network shares being deleted from the command line

(index=__your_sysmon_index__ EventCode=1) ((Image="C:\\Windows\\System32\\net.exe" AND CommandLine="*delete*") OR CommandLine="*Remove-SmbShare*" OR CommandLine="*Remove-FileShare*")

LogPointLogPoint Search - delete network sharesData model: LogPoint native

looks network shares being deleted from the command line

norm_id=WindowsSysmon event_id=1 ((image="C:\Windows\System32\net.exe" command="*delete*") OR command="*Remove-SmbShare*" OR command="*Remove-FileShare*")

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

4 more in the full list

View CAR-2020-11-007 on car.mitre.org

ATT&CK coverage

Technique	Tactics	Coverage
T1070 Indicator RemovalT1070.005	Stealth (formerly Defense Evasion)	High

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1070Indicator Removal
.005 Network Share Connection Removal

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Pseudocode and implementations

PseudocodePseudocode - network shares being removed via the command lineData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
target_processes = filter processes where (
  (exe="C:\\Windows\\System32\\net.exe" AND command_line="*delete*") OR
  command_line="*Remove-SmbShare*" OR
  comman_line="*Remove-FileShare*" )
output target_processes

SplunkSplunk Search - delete network sharesData model: Sysmon native

looks network shares being deleted from the command line

(index=__your_sysmon_index__ EventCode=1) ((Image="C:\\Windows\\System32\\net.exe" AND CommandLine="*delete*") OR CommandLine="*Remove-SmbShare*" OR CommandLine="*Remove-FileShare*")

LogPointLogPoint Search - delete network sharesData model: LogPoint native

looks network shares being deleted from the command line

norm_id=WindowsSysmon event_id=1 ((image="C:\Windows\System32\net.exe" command="*delete*") OR command="*Remove-SmbShare*" OR command="*Remove-FileShare*")