T1080 — Taint Shared Content

Tactic: Lateral Movement · Platforms: Windows, SaaS, Linux, macOS, Office Suite

Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise…

Sigma detection rules (5)

T1080 Taint Shared Content

title: T1080 Taint Shared Content
id: f1980773-41de-4c5a-aec1-bf337ea26900
description: 'Detection of Tainted Content Written to Shared Storage. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: SharedPathPrefix, ExecutableExtensions.'
references:
  - https://attack.mitre.org/techniques/T1080
author: Shahrukh Khan
date: 2026-06-10
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1080

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'

  selection_share:
    TargetFilename|startswith: '\\'

  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.lnk'
      - '.vbs'
      - '.js'
      - '.bat'
      - '.ps1'
      - '.scr'
      - '.hta'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_share and selection_ext and not filter_system_account

falsepositives:
  - Legitimate deployment of scripts/executables to network share software distribution points; tune SharedPathPrefix allowlists for known deployment shares.

level: medium

T1080 Taint Shared Content

title: T1080 Taint Shared Content
id: 65621dc8-cf4a-467d-a010-a944c9497ee6
description: 'Detection of Tainted Content Written to Shared Storage. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) The executable-permission check previously borrowed EXECVE''s a1 field without verifying a0 was chmod/install or that it referred to the same object as the PATH write, so it could spuriously correlate an unrelated command''s argv containing "0755" with an unconnected shared-mount write. Now uses the PATH record''s own mode field on the same shared-mount path, and checks a broader set of executable-bit permission patterns. Tune using: MountPath, FilenamePattern.'
references:
  - https://attack.mitre.org/techniques/T1080
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1080

logsource:
  category: file_change
  product: linux

detection:
  selection:
    type: PATH
    name|contains:
      - '/mnt/'
      - '/media/'
      - '/srv/nfs/'
    mode|endswith:
      - '755'
      - '775'
      - '777'
      - '711'
      - '551'
      - '111'

  condition: selection

falsepositives:
  - Legitimate deployment processes may write executable files to shared/mounted storage; scope to shares that are read-mostly or not part of normal deployment workflows.

level: medium

T1080 Taint Shared Content

title: T1080 Taint Shared Content
id: 9ffe2f93-d5b2-4ec7-bdde-a808e273d4ac
description: 'Detection of Tainted Content Written to Shared Storage. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FileExtensionDeception, TargetSharedFolder.'
references:
  - https://attack.mitre.org/techniques/T1080
author: Shahrukh Khan
date: 2026-03-01
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1080

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/Shared/'
      - '/Volumes/'
    TargetFilename|re: '\.(pdf|docx?|xlsx?)\.(app|command|scpt)
    
  



  condition: selection

falsepositives:
  - Double-extension deception on shared or network volumes has little legitimate use, though renamed backup files could occasionally match the pattern.

level: high

T1080 Taint Shared Content

title: T1080 Taint Shared Content
id: dde2a72f-bf65-414e-967a-e16d354fc017
description: 'Detection of Tainted Content Written to Shared Storage. (Data Component: File Creation; baseline tier: fallback.) Narrowed to plausible payload types: newly created files under shared-storage mount points that are either script/executable file types or created with executable permission bits set, rather than any file write to those paths. Tune using: UserUploadRateThreshold, MaliciousFileIndicator.'
references:
  - https://attack.mitre.org/techniques/T1080
author: Shahrukh Khan
date: 2026-03-22
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1080

logsource:
  category: file_event
  product: linux
  service: auditd

detection:
  selection:
    type: PATH
    nametype: CREATE
    name|contains:
      - '/srv/samba/'
      - '/mnt/share'
      - '/var/www/html'
      - '/export/nfs'
  selection_script_ext:
    name|endswith:
      - '.sh'
      - '.py'
      - '.pl'
      - '.php'
      - '.cgi'
      - '.exe'
      - '.elf'
      - '.bin'
      - '.so'
      - '.jar'
  selection_exec_mode:
    mode|endswith:
      - '755'
      - '750'
      - '700'
      - '775'
      - '777'
      - '711'

  condition: selection and (selection_script_ext or selection_exec_mode)

falsepositives:
  - Normal file creation by web deployment pipelines and legitimate users saving script or executable content into shared network or web-served directories (e.g. deploying a .sh install script or a .php app file); payload_hash comparison against a known-good baseline remains the strongest signal and requires an external file-integrity tool.

level: medium

T1080 Taint Shared Content

title: T1080 Taint Shared Content
id: d6a8bc23-9483-41af-941d-ec77a08ae4f4
description: 'Detection of Tainted Content Written to Shared Storage. Narrowed from any file create/write under common shared paths to newly created files (nametype CREATE, which auditd confirms as an actual write; NORMAL only confirms a path was referenced, not written, so it was dropped) that also carry a script or executable file extension, cutting out routine content updates that do not introduce new executable/script content. (Data Component: File Modification; baseline tier: fallback.) Tune using: MacroExecutionPolicy, SuspiciousKeywordMatch, SuspiciousExtensionList.'
references:
  - https://attack.mitre.org/techniques/T1080
author: Shahrukh Khan
date: 2026-06-12
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1080

logsource:
  category: file_change
  product: linux
  service: auditd

detection:
  selection_shared_path:
    type: PATH
    nametype: CREATE
    name|contains:
      - '/srv/samba/'
      - '/mnt/share'
      - '/var/www/html'
      - '/export/nfs'
  selection_suspicious_ext:
    name|endswith:
      - '.sh'
      - '.py'
      - '.pl'
      - '.php'
      - '.phtml'
      - '.cgi'
      - '.exe'
      - '.dll'
      - '.scr'
      - '.bat'
      - '.vbs'
      - '.elf'
      - '.so'
      - '.bin'

  condition: selection_shared_path and selection_suspicious_ext

falsepositives:
  - Legitimate deployment of new scripts, plugins, or executables to web/shared/NFS directories by CI/CD pipelines and administrators during routine releases.
  - In-place infection of an existing binary that keeps its original non-script extension and is opened for write rather than recreated will not produce a CREATE record and is missed here; pair with file-integrity/hash monitoring for that case.

level: medium

Explore