Official Description

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)
Tactics
Stealth
Platforms
Windows
Parent Technique
T1070 · Indicator Removal
MITRE Version
2.0
Last Modified
May 12, 2026

View on MITRE ATT&CK ↗