1200KM / detection
T1070.005 Network Share Connection Removal — Detection Rules
Detection workspace for T1070.005 Network Share Connection Removal: 4 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- PowerShell Deleted Mounted Share · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
- Unmount Share Via Net.EXE · test · low · {"category":"process_creation","product":"windows"}
- Disable Administrative Share Creation at Startup · test · medium · {"category":"registry_set","product":"windows"}
- MaxMpxCt Registry Value Changed · test · low · {"category":"registry_set","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0103 Behavioral Detection of Network Share Connection Removal via CLI and SMB Disconnects
AN0286 Analytic 0286
Detects network share disconnection attempts using command-line tools like `net use /delete`, PowerShell `Remove-SmbMapping`, and correlation with process lineage and SMB session teardown activity.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.