PowerShell Deleted Mounted Share

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•0•13

Detects when a mounted network share is removed using PowerShell cmdlets such as 'Remove-SmbShare' or 'Remove-FileShare'. This activity can be an indicator of an adversary cleaning up traces of their operations.