PowerShell Deleted Mounted Share

Status: test
Severity: medium
Log source: category ps_script, product windows
Author: oscd.community, @redcanary, Zach Stanford @svch0st
Source: github.com/SigmaHQ/sigma

Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

Known false positives

Administrators or Power users may remove their shares via cmd line

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1070.005` Indicator Removal: Network Share Connection Removal

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: PowerShell Deleted Mounted Share
id: 66a4d409-451b-4151-94f4-a55d559c49b0
status: test
description: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md
author: 'oscd.community, @redcanary, Zach Stanford @svch0st'
date: 2020-10-08
modified: 2025-10-07
tags:
    - attack.stealth
    - attack.t1070.005
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - 'Remove-SmbShare'
            - 'Remove-FileShare'
    filter_main_module_load:
        ScriptBlockText|contains|all:
            - 'FileShare.cdxml'
            - 'Microsoft.PowerShell.Core\Export-ModuleMember'
            - 'ROOT/Microsoft/Windows/Storage/MSFT_FileShare'
            - 'ObjectModelWrapper'
            - 'Cmdletization.MethodParameter'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Administrators or Power users may remove their shares via cmd line
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    ScriptBlockText|contains:
        - 'Remove-SmbShare'
        - 'Remove-FileShare'

Stage 2: `not filter_main_module_load`

filter_main_module_load:
    ScriptBlockText|contains|all:
        - 'FileShare.cdxml'
        - 'Microsoft.PowerShell.Core\Export-ModuleMember'
        - 'ROOT/Microsoft/Windows/Storage/MSFT_FileShare'
        - 'ObjectModelWrapper'
        - 'Cmdletization.MethodParameter'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ScriptBlockText`	match	`Cmdletization.MethodParameter`	`excludes:ScriptBlockText` `field:"ScriptBlockText" value:"Cmdletization.MethodParameter"`
`ScriptBlockText`	match	`FileShare.cdxml`	`excludes:ScriptBlockText` `field:"ScriptBlockText" value:"FileShare.cdxml"`
`ScriptBlockText`	match	`Microsoft.PowerShell.Core\Export-ModuleMember`	`excludes:ScriptBlockText` `field:"ScriptBlockText" value:"Microsoft.PowerShell.Core\Export-ModuleMember"`
`ScriptBlockText`	match	`ObjectModelWrapper`	`excludes:ScriptBlockText` `field:"ScriptBlockText" value:"ObjectModelWrapper"`
`ScriptBlockText`	match	`ROOT/Microsoft/Windows/Storage/MSFT_FileShare`	`excludes:ScriptBlockText` `field:"ScriptBlockText" value:"ROOT/Microsoft/Windows/Storage/MSFT_FileShare"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`Remove-FileShare` `Remove-SmbShare`	`field:"ScriptBlockText" kind:match`