atomic-red-team/atomics/T1126/T1126.yaml

---
attack_technique: T1126
display_name: Remove Network Share

atomic_tests:
- name: Add Network Share
  description: |
    Add a Network Share utilizing the command_prompt

  supported_platforms:
    - windows

  input_arguments:
    share_name:
      description: Share to add.
      type: string
      default: \\test\share

  executor:
    name: command_prompt
    elevation_required: false
    command: |
      net use c: #{share_name}
      net share test=#{share_name} /REMARK:"test share" /CACHE:No

- name: Remove Network Share
  description: |
    Removes a Network Share utilizing the command_prompt

  supported_platforms:
    - windows

  input_arguments:
    share_name:
      description: Share to remove.
      type: string
      default: \\test\share

  executor:
    name: command_prompt
    elevation_required: false
    command: |
      net share #{share_name} /delete

- name: Remove Network Share PowerShell
  description: |
    Removes a Network Share utilizing PowerShell

  supported_platforms:
    - windows

  input_arguments:
    share_name:
      description: Share to remove.
      type: string
      default: \\test\share

  executor:
    name: powershell
    elevation_required: false
    command: |
      Remove-SmbShare -Name #{share_name}
      Remove-FileShare -Name #{share_name}