Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)
Network Share Connection Removal
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1070/005  external_id: T1070.005     source_name: Technet Net Use  description: Microsoft. (n.d.). Net Use. Retrieved November 25, 2016.  url: https://technet.microsoft.com/bb490717.aspx     