MITRE ATT&CK Technique
T1070.005Network Share Connection Removal
- First Reported
- —
- Latest Reported
- —
Official Description
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)
- Tactics
- Stealth
- Platforms
- Windows
- Parent Technique
- T1070 · Indicator Removal
- MITRE Version
- 2.0
- Last Modified
- May 12, 2026