Windows SecurityObject Access

Event 5144: A network share object was deleted.

A network share object was deleted.

Technical Details

Windows Security Source

Event ID: 5144

Windows Security- Object Access

Event Description

A network share object was deleted.

Key Log Fields

  • SubjectUserName - Account that deleted the share
  • SubjectDomainName - Domain of the account
  • SubjectLogonId - Logon ID for correlation
  • ShareName - Name of the deleted share
  • ShareLocalPath - Local path of the deleted share

MITRE ATT&CK® Mapping (1)

T1070.005defense-evasion
Network Share Connection Removal

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)

Contents