T1080

Taint Shared Content

Windows · SaaS · Linux · macOS · Office Suitenothing on this site yetT1080 on attack.mitre.org

Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detection of Tainted Content Written to Shared Storage

Detects adversary tampering of shared directories via file drops (e.g., malicious LNK, EXE, VBS) followed by user execution or suspicious network activity.
Detects script or binary modification within shared NFS/SMB directories followed by process execution from those paths.
Detects modification of shared network folders via.app bundles or scripting files with hidden extensions (e.g., double extensions like docx.app).
Detects upload of malicious or unusual file types into cloud-shared folders, followed by user downloads or interactions.

what reduces it

M1038 Execution Prevention. Identify potentially malicious software that may be used to taint content or may result from it and audit and/or block the unknown programs by using application control tools, like AppLocker, or Software Restriction Policies where appropriate.
M1022 Restrict File and Directory Permissions. Protect shared folders by minimizing users who have write access.
M1049 Antivirus/Antimalware. Anti-virus can be used to automatically quarantine suspicious files.
M1050 Exploit Protection. Use utilities that detect or mitigate common features used in exploitation, such as the Microsoft Enhanced Mitigation Experience Toolkit (EMET).

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.