Add T1126 removing network shares

2018-07-01 20:14:29 -05:00
parent b0170998df
commit 912b84d2e6
1 changed files with 42 additions and 0 deletions
@@ -0,0 +1,42 @@
+---
+attack_technique: T1126
+display_name: Remove Network Share
+
+atomic_tests:
+- name: Remove Network Share
+  description: |
+    Removes a Network Share utilizing the command_prompt
+
+  supported_platforms:
+    - windows
+
+  input_arguments:
+    share_name:
+      description: Share to remove.
+      type: string
+      default: \\test\share
+
+  executor:
+    name: command_prompt
+    command: |
+      net share #{share_name} /delete
+
+- name: Remove Network Share PowerShell
+  description: |
+    Removes a Network Share utilizing PowerShell
+
+  supported_platforms:
+    - windows
+
+  input_arguments:
+    share_name:
+      description: Share to remove.
+      type: string
+      default: \\test\share
+
+  executor:
+    name: powershell
+    command: |
+      Remove-SmbShare -Name #{share_name}
+      Remove-FileShare -Name #{share_name}
+