On a Windows system, an attacker used the command prompt to remove one or more default administrative shares. Which share names were deleted?

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName =~ "cmd.exe"
| where ProcessCommandLine contains "net share" and ProcessCommandLine contains "/delete"
| extend ShareNameDeleted = extract(@'net share ([^\s]+) /delete', 1, ProcessCommandLine)
| where isnotempty(ShareNameDeleted)
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, ShareNameDeleted, AccountName

DeviceProcessEvents
| where ProcessCommandLine contains 'net share' and (ProcessCommandLine contains '/delete' or ProcessCommandLine contains ' /d')
| project DeviceName, ProcessCommandLine, TimeGenerated

let defaultAdminShares = dynamic(["ADMIN$","IPC$","C$","D$","E$","F$","G$","H$","I$","J$","K$","L$","M$","N$","O$","P$","Q$","R$","S$","T$","U$","V$","W$","X$","Y$","Z$"]);
DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName in~ ("net.exe","net1.exe")
| where InitiatingProcessFileName =~ "cmd.exe"  // ensured run from Command Prompt
| extend cmd = tostring(ProcessCommandLine)
| where cmd matches regex @"(?i)\bnet(\.exe)?\s+share\b" and cmd matches regex @"(?i)\s/(?:delete|del)\b"
| extend ShareName = toupper(extract(@"(?i)\bshare\s+['\""]?([A-Za-z0-9_\-]+[$])['\""]?", 1, cmd))
| where ShareName in (defaultAdminShares)
| distinct ShareName

// Find deletions of administrative shares (e.g., C$, ADMIN$, IPC$) performed via cmd.exe/net.exe/reg.exe
union isfuzzy=true DeviceEvents, DeviceProcessEvents
| where (ProcessCommandLine has_cs "net share" or ProcessCommandLine has_cs "net share" or InitiatingProcessCommandLine has_cs "net share"
        or ProcessCommandLine has_cs "net.exe" or InitiatingProcessCommandLine has_cs "net.exe"
        or ProcessCommandLine has_cs "reg delete" or InitiatingProcessCommandLine has_cs "reg delete"
        or ProcessCommandLine has_cs "sc delete" or InitiatingProcessCommandLine has_cs "sc delete")
  and (FileName has_cs "cmd.exe" or FileName has_cs "net.exe" or FileName has_cs "reg.exe" or FileName has_cs "sc.exe"
       or InitiatingProcessFileName has_cs "cmd.exe" or InitiatingProcessFileName has_cs "net.exe" or InitiatingProcessFileName has_cs "reg.exe" or InitiatingProcessFileName has_cs "sc.exe")
| extend cmdline = coalesce(ProcessCommandLine, InitiatingProcessCommandLine)
| extend share = extract(@"(?:net\s+share\s+)([A-Za-z0-9\$]+)", 1, tostring(cmdline))
| extend share_reg = extract(@"(?:\\\?\\)?HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SvcHost\\.*?" , 0, tostring(RegistryKey))
| extend share2 = iff(isnotempty(share), share, extract(@"(?:/delete\s+|delete\s+)([A-Za-z0-9\$]+)", 1, tostring(cmdline)))
| extend share3 = iff(isnotempty(share2), share2, extract(@"([A-Za-z]:\$|[A-Za-z0-9_]+\$)", 1, tostring(cmdline)))
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, FileName, InitiatingProcessFileName, cmdline, share = share3
| where isnotempty(share)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count() by DeviceName, share
| order by LastSeen desc

let AllDeletedShares = union DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents
| where TimeGenerated >= ago(30d)
| extend CmdLine = coalesce(InitiatingProcessCommandLine, ProcessCommandLine)
| where CmdLine contains "net share"
| extend ShareName = tostring(extract(@"net\s+share\s+([^\\s/]+)", 1, CmdLine))
| where isnotempty(ShareName)
| summarize DeletedShareNames = makeset(ShareName);
AllDeletedShares

DeviceProcessEvents
| where ProcessCommandLine contains 'net share' and ProcessCommandLine contains '/delete'
| extend ShareName = extract(@'net share (\S+)', 1, ProcessCommandLine)  // Extracts the share name after 'net share'
| where isnotempty(ShareName)  // Ensures only valid extractions are kept
| project Timestamp, DeviceName, ShareName, ProcessCommandLine  // Projects key fields for review

DeviceProcessEvents
| where FileName =~ "cmd.exe"
| where ProcessCommandLine has_all ("net", "share", "/delete")
| parse kind=regex ProcessCommandLine with @"net share " ShareName @" /delete" *
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, ShareName, ProcessCommandLine

// Administrative shares deleted from the endpoint
DeviceProcessEvents
| where TimeGenerated between (startofday(ago(7d)) .. now())   // << replace/override with your time-picker
| where FileName in~ ("net.exe", "wmic.exe", "powershell.exe")
// Normalise the command line for easier string matching
| extend cmd = tolower(ProcessCommandLine)
// Keep only executions that look like a share-deletion command
| where (FileName =~ "net.exe"       and cmd contains " share " and cmd contains "/delete")
       or (FileName =~ "wmic.exe"      and cmd contains " share " and cmd contains " delete")
       or (FileName =~ "powershell.exe" and cmd contains "remove-smbshare")
// Extract the name of the share that is being deleted – pattern differs per tool
| extend DeletedShare = case(
        FileName =~ "net.exe",        extract("net\\s+share\\s+([^\\s]+)",             1, cmd),
        FileName =~ "wmic.exe",       extract("name=\"([^\"]+)\"",                  1, cmd),
        FileName =~ "powershell.exe", extract("-name\\s+\"([^\"]+)\"",              1, cmd),
        "")
| where isnotempty(DeletedShare) and DeletedShare endswith "$"   // focus on default admin shares
| project TimeGenerated,
          DeviceName,
          User = iff(isempty(AccountDomain), AccountName, strcat(AccountDomain, "\\", AccountName)),
          FileName,
          ProcessCommandLine,
          DeletedShare
| sort by TimeGenerated desc

DeviceProcessEvents
| where InitiatingProcessFileName =~ "cmd.exe"
| where InitiatingProcessCommandLine contains "net share" and InitiatingProcessCommandLine contains "/delete"
| extend shareName = extract("net\\s+share\\s+([^\\s]+)\\s+/delete", 1, InitiatingProcessCommandLine)
| where isnotempty(shareName)
| summarize by shareName
| project shareName

// 1) Registry-based share deletions
let RegistryDeletion = DeviceRegistryEvents
| where ActionType == "ValueDeleted"
| where RegistryKey startswith @"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Shares"
| extend ShareName = RegistryValueName
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, ShareName;

// 2) "net share <ShareName> /delete" command
let NetShareDelete = DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine matches regex @"(?i)\bnet\s+share\s+\S+\s+/delete\b"
| extend ShareName = tostring(split(trim(@"/", ProcessCommandLine), ' ')[2])
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, ShareName;

// 3) PowerShell Remove-SmbShare -Name <ShareName>
let RemoveSmbShare = DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where ProcessCommandLine matches regex @"(?i)\bRemove-SmbShare\s+-Name\s+\S+\b"
| extend ShareName = extract(@"Remove-SmbShare\s+-Name\s+(\S+)", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, ShareName;

// Combine all and sort descending by time
RegistryDeletion
| union NetShareDelete
| union RemoveSmbShare
| sort by TimeGenerated desc

DeviceProcessEvents
| where ActionType == "ProcessCreated"
// Catch both 32-bit and 64-bit invocations of net.exe
| where FileName in~ ("net.exe", "net1.exe")
// Look for the share deletion syntax
| where tolower(ProcessCommandLine) has "share" and tolower(ProcessCommandLine) has "/delete"
// Extract the share name between "net share" and "/delete"
| extend ShareName = extract(@"(?i)net\s+share\s+([^\s]+)\s+/delete", 1, ProcessCommandLine)
| where isnotempty(ShareName)
// List each deletion or aggregate by share
| summarize DeletionCount = count() by ShareName
| sort by DeletionCount desc