LoFP / t1070.005

t1070.005

Title	Tags
administrators often leverage net.exe to create or delete network shares. you should verify that the activity was intentional and is legitimate.	t1070 t1070.005 endpoint splunk
administrators or power users may remove their shares via cmd line	t1070 t1070.005 windows sigma