tfMITRE ATT&CK technique

Taint Shared Content T1080

Tactic: Lateral Movement
Platforms: Windows, SaaS, Linux, macOS, Office Suite
Version: 1.6
Created: 31 May 2017
Last modified: 24 October 2025
Contributors: Michal Dida, ESET; David Routin

Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware71st pct

Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Taint Shared Content MITRE reference T1080

73rd pctamong all ATT&CK techniques for number of groups

5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

RedCurlG1039 ↗

Has placed modified LNK files on network drives for lateral movement.1 2

created 2024-09-232 references

Cinnamon TempestG1021 ↗

Has deployed ransomware from a batch file in a network share.1

created 2023-12-061 referenceaka DEV-0401

BRONZE BUTLERG0060 ↗

Has placed malware on file shares and given it the same name as legitimate documents on the share.1

created 2018-01-161 referenceaka REDBALDKNIGHT

Gamaredon GroupG0047 ↗

Has injected malicious macros into all Word and Excel documents on mapped network drives.1

created 2017-05-311 referenceaka IRON TILDEN

DarkhotelG0012 ↗

Used a virus that propagates by infecting executables stored on shared drives.1

created 2017-05-311 referenceaka DUBNIUM

All 5 groups for this technique

Offense vs defense T1080

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Taint Shared Content detection strategy DET0471

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Tainted Content Written to Shared Storage

Enterprise

5 platforms

AN1298 · Windows

Detects adversary tampering of shared directories via file drops (e.g., malicious LNK, EXE, VBS) followed by user execution or suspicious network activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Share AccessDC0102	WinEventLog:Security	EventCode=5145

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SharedPathPrefix	Defines monitored shared directories (e.g., \\server\HR\).
ExecutableExtensions	Monitored file types dropped in shared paths (e.g., .lnk, .exe, .vbs).

AN1299 · Linux

Detects script or binary modification within shared NFS/SMB directories followed by process execution from those paths.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	auditd:SYSCALL	write
Network Share AccessDC0102	NSM:Flow	smb_files.log

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MountPath	Mount path of monitored shared volumes (e.g., /mnt/shared).
FilenamePattern	Pattern matching of abnormal or disguised filenames.

AN1300 · macOS

Detects modification of shared network folders via .app bundles or scripting files with hidden extensions (e.g., double extensions like docx.app).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	fs:fsevents	Directory events (kFSEventStreamEventFlagItemCreated)
File ModificationDC0061	macos:unifiedlog	file writes

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FileExtensionDeception	Monitors use of hidden extensions or double extensions.
TargetSharedFolder	Defines sensitive shared folders (e.g., /Users/Shared/HR).

AN1301 · SaaS

Detects upload of malicious or unusual file types into cloud-shared folders, followed by user downloads or interactions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	gcp:workspaceaudit	drive.activity logs
Network Share AccessDC0102	m365:unified	FileUploaded, FileAccessed

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserUploadRateThreshold	Abnormal upload patterns into shared drives.
MaliciousFileIndicator	File hash or known-bad filename pattern matching.

AN1302 · Office Suite

Detects embedded macros or scripts added to shared documents or use of external references to execute code.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	m365:defender	OfficeTelemetry or DLP

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MacroExecutionPolicy	Controls macro execution based on user or group policy.
SuspiciousKeywordMatch	Regex match on suspicious VBA function names or calls.

Taint Shared Content detections T1080

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs