CAR-2020-11-007.yaml

title: Network Share Connection Removal
submission_date: 2020/11/30
information_domain: Host
platforms:
  - Windows
subtypes:
  - Process
analytic_types:
  - TTP
contributors:
  - Olaf Hartong
id: CAR-2020-11-007
description: |-
  Adversaries may use network shares to exfliltrate date; they will then remove the shares to cover their tracks. This analytic looks for the removal of network shares via commandline, which is otherwise a rare event.
coverage:
  - technique: T1070
    tactics:
      - TA0005
    subtechniques:
      - T1070.005
    coverage: High
implementations:
  - name: Pseudocode - network shares being removed via the command line
    description: This is a pseudocode representation of the below splunk search.
    code: |- 
      processes = search Process:Create
      target_processes = filter processes where (
        (exe="C:\\Windows\\System32\\net.exe" AND command_line="*delete*") OR
        command_line="*Remove-SmbShare*" OR
        comman_line="*Remove-FileShare*" )
      output target_processes
    data_model: CAR native
    type: Pseudocode
  - name: Splunk Search - delete network shares
    description: looks network shares being deleted from the command line
    code: |- 
      (index=__your_sysmon_index__ EventCode=1) ((Image="C:\\Windows\\System32\\net.exe" AND CommandLine="*delete*") OR CommandLine="*Remove-SmbShare*" OR CommandLine="*Remove-FileShare*")
    data_model: Sysmon native
    type: Splunk
  - name: LogPoint Search - delete network shares
    description: looks network shares being deleted from the command line
    code: |- 
      norm_id=WindowsSysmon event_id=1 ((image="C:\Windows\System32\net.exe" command="*delete*") OR command="*Remove-SmbShare*" OR command="*Remove-FileShare*")
    data_model: LogPoint native
    type: LogPoint
data_model_references:
  - process/create/exe
  - process/create/command_line
d3fend_mappings:
  - iri: d3f:ProcessSpawnAnalysis
    id: D3-PSA
    label: Process Spawn Analysis