Windows net.exe Unmount Share (/delete) Execution

title: Windows net.exe Unmount Share (/delete) Execution
id: ee1127bd-8b9c-4c47-a540-8eddb4968bd1
status: test
description: This rule identifies process executions of net.exe (or net1.exe) with command-line parameters that include both "share" and "/delete", indicating an unmount or removal of a mounted share connection. Attackers may use share removal to reduce available artifacts and clean up after accessing network resources. It relies on Windows process creation telemetry, specifically the executable name/path and the command-line content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_share_unmount.yml
author: oscd.community, @redcanary, Zach Stanford @svch0st, Huntrule Team
date: 2020-10-08
modified: 2023-02-21
tags:
  - attack.stealth
  - attack.t1070.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \net.exe
        - \net1.exe
    - OriginalFileName:
        - net.exe
        - net1.exe
  selection_cli:
    CommandLine|contains|all:
      - share
      - /delete
  condition: all of selection*
falsepositives:
  - Administrators or Power users may remove their shares via cmd line
level: low
license: DRL-1.1
related:
  - id: cb7c4a03-2871-43c0-9bbb-18bbdb079896
    type: derived