Unmount Share Via Net.EXE
Detects when the 'net.exe' or 'net1.exe' utility is used with the 'share' and '/delete' commands to remove a mounted network share. This activity can be performed by adversaries to clean up traces of their operations.
Sigma
Detects when the 'net.exe' or 'net1.exe' utility is used with the 'share' and '/delete' commands to remove a mounted network share. This activity can be performed by adversaries to clean up traces of their operations.
Already have an account?