AN0286
Analytic 0286
Windows
Detects network share disconnection attempts using command-line tools like `net use /delete`, PowerShell `Remove-SmbMapping`, and correlation with process lineage and SMB session teardown activity.
WinEventLog:Security
EventCode=4624, 4648
WinEventLog:Sysmon
EventCode=1
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
NSM:Flow
SMB2_LOGOFF/SMB_TREE_DISCONNECT
[TimeWindow]
Adjustable window to correlate CLI disconnection command with SMB session teardown (e.g., 5 mins)
[UserContext]
Used to filter on non-interactive users or highly privileged accounts
[ProcessCommandLineRegex]
Patterns to match `net use \\host\share /delete`, `Remove-SmbMapping`, or suspicious batched disconnections
[NetworkShareNamePattern]
Tunable list of shares likely targeted (e.g., ADMIN$, C$, IPC$)