PowerShell Deleted Mounted Share

Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

View on GitHub Open raw file

Detection logic

selection

ScriptBlockText|contains:
  - Remove-SmbShare
  - Remove-FileShare

filter_main_module_load

ScriptBlockText|contains|all:
  - FileShare.cdxml
  - Microsoft.PowerShell.Core\Export-ModuleMember
  - ROOT/Microsoft/Windows/Storage/MSFT_FileShare
  - ObjectModelWrapper
  - Cmdletization.MethodParameter

Condition

selection and not 1 of filter_main_*

Raw YAML

title: PowerShell Deleted Mounted Share
id: 66a4d409-451b-4151-94f4-a55d559c49b0
status: test
description: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md
author: 'oscd.community, @redcanary, Zach Stanford @svch0st'
date: 2020-10-08
modified: 2025-10-07
tags:
    - attack.stealth
    - attack.t1070.005
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - 'Remove-SmbShare'
            - 'Remove-FileShare'
    filter_main_module_load:
        ScriptBlockText|contains|all:
            - 'FileShare.cdxml'
            - 'Microsoft.PowerShell.Core\Export-ModuleMember'
            - 'ROOT/Microsoft/Windows/Storage/MSFT_FileShare'
            - 'ObjectModelWrapper'
            - 'Cmdletization.MethodParameter'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Administrators or Power users may remove their shares via cmd line
level: medium