MITRE CAR unknown stable spl
Network Share Connection Removal
Adversaries may use network shares to exfliltrate date; they will then remove the shares to cover their tracks. This analytic looks for the removal of network shares via commandline, which is otherwise a rare event.
Detection Logic
(index=__your_sysmon_index__ EventCode=1) ((Image="C:\\Windows\\System32\\net.exe"
AND CommandLine="*delete*")
OR CommandLine="*Remove-SmbShare*"
OR CommandLine="*Remove-FileShare*")Field Validations
Loading…
Comments (0)
Loading comments...