Techniques › T1080
T1080 Taint Shared Content
lateral movement — Windows, SaaS, Linux, macOS, Office Suite · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1080
0
KEV CVEs mapped here
<p>Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.</p><p>A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses Shortcut Modification of directory .LNK files that use Masquerading to look like the real directories, which are hidden through Hidden Files and Directories. The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts.</p><p>Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0471 Detection of Tainted Content Written to Shared Storage v1.0
AN1298 WindowsDetects adversary tampering of shared directories via file drops (e.g., malicious LNK, EXE, VBS) followed by user execution or suspicious network activity.Tunable:
SharedPathPrefixExecutableExtensionsAN1299 LinuxDetects script or binary modification within shared NFS/SMB directories followed by process execution from those paths.Tunable:MountPathFilenamePatternAN1300 macOSDetects modification of shared network folders via .app bundles or scripting files with hidden extensions (e.g., double extensions like docx.app).Tunable:FileExtensionDeceptionTargetSharedFolderAN1301 SaaSDetects upload of malicious or unusual file types into cloud-shared folders, followed by user downloads or interactions.Tunable:UserUploadRateThresholdMaliciousFileIndicatorAN1302 Office SuiteDetects embedded macros or scripts added to shared documents or use of external references to execute code.Tunable:MacroExecutionPolicySuspiciousKeywordMatch
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1080
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.