Taint Shared Content `T1080`

Tactic: Lateral Movement

Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.

Events covered

2 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Security-Auditing	Event ID 4688	A new process has been created.

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventID`	4	`eq` 4	`sharepointfileoperation`, `1`, `4688`
`EventType`	2	`eq` 2	`filemalwaredetected`
`Provider_Name`	2	`eq` 2	`onedrive`, `sharepoint`
`data_stream.dataset`	2	`eq` 2	`o365.audit`
`parent_process_name`	2	`regex_match` 2	`(?i)\x5cUsers\x5cPublic\x5c\.exe`
`process_name`	2	`regex_match` 2	`(?i)\x5cappdata\x5clocal\x5ctemp\x5c.+\.tmp`
`Type`	1	`eq` 1

Top indicator values (9 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`EventID`	`eq`	`sharepointfileoperation` elasticM365 OneDrive Malware File Upload elasticM365 SharePoint Malware File Detected	2	2
`EventID`	`eq`	`1` splunkTemporary File Executed from Public Folder (Sysmon)	1	241
`EventID`	`eq`	`4688` splunkTemporary File Executed from Public Folder (Windows Event Log)	1	317
`EventType`	`eq`	`filemalwaredetected` elasticM365 OneDrive Malware File Upload elasticM365 SharePoint Malware File Detected	2	2
`data_stream.dataset`	`eq`	`o365.audit` elasticM365 OneDrive Malware File Upload elasticM365 SharePoint Malware File Detected	2	47
`parent_process_name`	`regex_match`	`(?i)\x5cUsers\x5cPublic\x5c\.exe` splunkTemporary File Executed from Public Folder (Sysmon) splunkTemporary File Executed from Public Folder (Windows Event Log)	2	2
`process_name`	`regex_match`	`(?i)\x5cappdata\x5clocal\x5ctemp\x5c.+\.tmp` splunkTemporary File Executed from Public Folder (Sysmon) splunkTemporary File Executed from Public Folder (Windows Event Log)	2	2
`Provider_Name`	`eq`	`onedrive` elasticM365 OneDrive Malware File Upload	1	2
`Provider_Name`	`eq`	`sharepoint` elasticM365 SharePoint Malware File Detected	1

Rules under this technique

These vendors publish rules tagged with this technique.

Taint Shared Content `T1080`

Events covered

Authoring guide

Fields filtered most (7 distinct)

Top indicator values (9 distinct)

Rules under this technique

Elastic 2 rules

Splunk 2 rules

Taint Shared Content T1080

Events covered

Authoring guide

Fields filtered most (7 distinct)

Top indicator values (9 distinct)

Rules under this technique

Elastic 2 rules

Splunk 2 rules

Taint Shared Content `T1080`