Network share unmapped via net use or Remove-SmbMapping

Siemphony@siemphonylowT1070.005unverifiedPlaybook · Defence evasion

Matches AN0286's command-line half: a new process whose command line tears down an SMB share mapping, either the built-in `net use \\host\share /delete` (and its `net1.exe` twin, which `net.exe` re-execs on 64-bit Windows for the same verb) or the PowerShell `Remove-SmbMapping` cmdlet. This is deliberately not written against the brief's Security 4624/4648 logsource: those are Logon Session Creation events, and neither carries a disconnect or session-teardown record at all, despite AN0286's own description naming "SMB session teardown activity" as part of what it correlates — there is no field on either EventID that reflects a share being removed, so a rule keyed on them would validate and never fire. The PowerShell 4103/4106 logsource is also not used: Remove-SmbMapping typed into an already-open interactive console produces no new process_creation event at all, only a module/script-block log entry, so this selection only catches the cmdlet when it arrives as an argument to a freshly spawned powershell.exe (e.g. `powershell -Command "Remove-SmbMapping -ShareName *"`) — a real but partial view of MITRE's own NetworkShareNamePattern and ProcessCommandLineRegex knobs, not the interactive case. MITRE's TimeWindow knob (correlating the CLI command with the actual SMB session teardown) is a cross-event join lib/sigma cannot express, so this fires on the command line alone, with no confirmation the disconnect actually succeeded. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0103, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Network share unmapped via net use or Remove-SmbMapping2id: 91342374-abdb-4dca-bce7-ee8ff9ade64a3status: experimental4description: |5  Matches AN0286's command-line half: a new process whose command line tears6  down an SMB share mapping, either the built-in `net use \\host\share7  /delete` (and its `net1.exe` twin, which `net.exe` re-execs on 64-bit8  Windows for the same verb) or the PowerShell `Remove-SmbMapping` cmdlet.9  This is deliberately not written against the brief's Security 4624/464810  logsource: those are Logon Session Creation events, and neither carries a11  disconnect or session-teardown record at all, despite AN0286's own12  description naming "SMB session teardown activity" as part of what it13  correlates — there is no field on either EventID that reflects a share14  being removed, so a rule keyed on them would validate and never fire. The15  PowerShell 4103/4106 logsource is also not used: Remove-SmbMapping typed16  into an already-open interactive console produces no new process_creation17  event at all, only a module/script-block log entry, so this selection only18  catches the cmdlet when it arrives as an argument to a freshly spawned19  powershell.exe (e.g. `powershell -Command "Remove-SmbMapping -ShareName20  *"`) — a real but partial view of MITRE's own NetworkShareNamePattern and21  ProcessCommandLineRegex knobs, not the interactive case. MITRE's TimeWindow22  knob (correlating the CLI command with the actual SMB session teardown) is23  a cross-event join lib/sigma cannot express, so this fires on the command24  line alone, with no confirmation the disconnect actually succeeded.25  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0103, not hand-written and not tested by its author. Any lab result is on this rule's own page.26references:27  - https://attack.mitre.org/techniques/T1070/00528  - https://attack.mitre.org/detectionstrategies/DET010329author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)30date: 2026-08-1831tags:32  - attack.defense-evasion33  - attack.t1070.00534logsource:35  category: process_creation36  product: windows37detection:38  selection_net_delete:39    Image|endswith:40      - '\net.exe'41      - '\net1.exe'42    CommandLine|contains|all:43      - 'use '44      - '/delete'45  selection_psh_removesmb:46    CommandLine|contains: 'Remove-SmbMapping'47  condition: 1 of selection*48falsepositives:49  - "Logon and logoff scripts, whether local GPO scripts or login scripts on a file server, that run `net use * /delete` or target a specific drive letter at every session end to tear down mapped drives before the next user logs on — the single highest-volume source of this command line on any domain-joined fleet."50  - "SCCM, Intune and imaging/provisioning tooling that removes stale share mappings left from a previous user profile as a routine step of machine setup or re-provisioning."51  - "VDI and RDS session-teardown scripts, and roaming-profile management tooling, that call Remove-SmbMapping or net use /delete against persistent share mappings when a non-persistent session ends, so this fires on every logoff in that environment."52level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and (ProcessCommandLine contains "use " and ProcessCommandLine contains "/delete")) or ProcessCommandLine contains "Remove-SmbMapping")

Splunk · SPL

Run this as a search.

index=* (((Image="*\\net.exe" OR Image="*\\net1.exe") AND (CommandLine="*use *" AND CommandLine="*/delete*")) OR CommandLine="*Remove-SmbMapping*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND (TO_LOWER(process.command_line) LIKE "*use *" AND TO_LOWER(process.command_line) LIKE "*/delete*")) OR TO_LOWER(process.command_line) LIKE "*remove-smbmapping*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:use ))(?=.*(?:/delete)).*</field>    <description>Network share unmapped via net use or Remove-SmbMapping (1/2)</description>    <mitre>      <id>T1070.005</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)Remove-SmbMapping</field>    <description>Network share unmapped via net use or Remove-SmbMapping (2/2)</description>    <mitre>      <id>T1070.005</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: defense_evasion_clear_logs
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 91342374-abdb-4dca-bce7-ee8ff9ade64a

ATT&CKT1070.005

T1070.005Network Share Connection Removal

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Not verified

Security Datasets — Network share connection removal
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1070.005, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Start by suppressing known logoff-script and imaging-tool parent processes or scheduled-task contexts, since those account for most of the volume above. If your environment doesn't run VDI/RDS, drop that false positive assumption and consider raising level. Because this only fires on freshly spawned PowerShell, pair it with PowerShell 4104 script-block logging if you need to catch Remove-SmbMapping typed interactively.

Declared by the author

Logon and logoff scripts, whether local GPO scripts or login scripts on a file server, that run net use * /delete or target a specific drive letter at every session end to tear down mapped drives before the next user logs on — the single highest-volume source of this command line on any domain-joined fleet.
SCCM, Intune and imaging/provisioning tooling that removes stale share mappings left from a previous user profile as a routine step of machine setup or re-provisioning.
VDI and RDS session-teardown scripts, and roaming-profile management tooling, that call Remove-SmbMapping or net use /delete against persistent share mappings when a non-persistent session ends, so this fires on every logoff in that environment.

Lessondefense evasion clear logs

defense evasion clear logsAI draft — unreviewed

01 · What this rule detects

This rule looks for a process command line that tears down an SMB share mapping: either the built-in net use \host\share /delete (and its net1.exe twin, which net.exe re-execs on 64-bit Windows for the same verb) or the PowerShell Remove-SmbMapping cmdlet. It covers only the command-line half of MITRE's AN0286 analytic — an attacker unmapping a share after copying data off it, to remove the connection from evidence.

02 · Telemetry you need

Sysmon or Security 4688 process_creation events on Windows, with command-line logging enabled. That is the only logsource this rule uses. The brief also lists Security 4624/4648 (Logon Session Creation) as part of AN0286, but neither carries a disconnect or teardown record — there is no field on either event reflecting a share being removed — so a rule keyed on them would validate cleanly and never fire. That pairing is deliberately skipped here.

03 · How the logic works

selection_net_delete requires Image ending in \net.exe or \net1.exe AND a CommandLine containing both 'use ' (with a trailing space) and '/delete'. The trailing space matters: an earlier draft used a bare 'use' substring, which also matches inside net user <account> /delete — deleting an account, an unrelated action — because user contains use. The space after use is present in net use \host\share /delete but is followed by r in net user, so it discriminates the two verbs. This was caught in review and is fixed in the current rule. selection_psh_removesmb independently matches any CommandLine containing Remove-SmbMapping. The condition is 1 of selection* — either branch alone is enough to fire. Note what this cannot see: Remove-SmbMapping typed into an already-open interactive PowerShell console produces no new process_creation event at all, only a module/script-block log entry. This selection only catches the cmdlet when it arrives as an argument to a freshly spawned powershell.exe, e.g. powershell -Command "Remove-SmbMapping -ShareName *". MITRE's TimeWindow knob — correlating the CLI command with the actual SMB session teardown — is a cross-event join the rule engine here cannot express, so this fires on the command line alone, with no confirmation the disconnect actually succeeded.

04 · Common false positives

Logoff and logon scripts (local GPO or file-server login scripts) that run
SCCM, Intune and imaging/provisioning tooling clearing stale share
VDI/RDS session-teardown scripts and roaming-profile tooling calling

05 · Detection maturity

tier_1: This rule has never been run against a log line. It is a scaffold, not a tuned detection — treat it as the lowest DeBMM tier until it has been validated against real telemetry in your environment and the false-positive list has been confirmed or revised against actual data.

Related detections1 nearby

Persistence artefact removed via service, task or account deletion

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/91342374-abdb-4dca-bce7-ee8ff9ade64a

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Network share unmapped via net use or Remove-SmbMapping

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it