Find sigma rule 
Attack: Indicator Removal on Host: Network Share Connection Removal
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with the net use \\system\share /delete command. (Citation: Technet Net Use)
MITRE
Tactic
- defense-evasion
technique
- T1070.005
Test : Remove Administrative Shares
OS
- windows
Description:
Administrative shares are hidden network shares created by Microsoft’s Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system. As Microsoft puts it, “Missing administrative shares typically indicate that the computer in question has been compromised by malicious software. https://threatpost.com/conti-ransomware-gang-has-full-log4shell-attack-chain/177173/
Executor
command_prompt
Sigma Rule
-
proc_creation_win_net_execution.yml (id: 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac)
-
proc_creation_win_net_share_unmount.yml (id: cb7c4a03-2871-43c0-9bbb-18bbdb079896)