Files
atomic-red-team/atomics/T1126/T1126.yaml
T
2018-07-01 20:14:29 -05:00

43 lines
828 B
YAML

---
attack_technique: T1126
display_name: Remove Network Share
atomic_tests:
- name: Remove Network Share
description: |
Removes a Network Share utilizing the command_prompt
supported_platforms:
- windows
input_arguments:
share_name:
description: Share to remove.
type: string
default: \\test\share
executor:
name: command_prompt
command: |
net share #{share_name} /delete
- name: Remove Network Share PowerShell
description: |
Removes a Network Share utilizing PowerShell
supported_platforms:
- windows
input_arguments:
share_name:
description: Share to remove.
type: string
default: \\test\share
executor:
name: powershell
command: |
Remove-SmbShare -Name #{share_name}
Remove-FileShare -Name #{share_name}