{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1080","id":"T1080","name":"Taint Shared Content","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1080","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"7f099abca347da4de7a758264a00170fba8c789e8ee3f3341648ad105800d38a","description":"\nAdversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.\n\nA directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses [Shortcut Modification](https://attack.mitre.org/techniques/T1547/009) of directory .LNK files that use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like the real directories, which are hidden through [Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001). The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts. (Citation: Retwin Directory Share Pivot)\n\nAdversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1080","external_id":"T1080"},{"source_name":"Retwin Directory Share Pivot","description":"Routin, D. (2017, November 13). Abusing network shares for efficient lateral movements and privesc (DirSharePivot). Retrieved April 12, 2018.","url":"https://rewtin.blogspot.ch/2017/11/abusing-user-shares-for-efficient.html"}],"platforms":["Windows","SaaS","Linux","macOS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0102","name":"Network Share Access","page":"telemetry/DC0102/","kind":"attack_component","category":"Windows and directory audit","description":"Access to a network share or an object through that share.","collection_focus":"Enable Audit File Share / Detailed File Share on the lab file server; correlate share checks with file-system access and requesting host/account.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["share","relative_path","access","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0102","collector":"illustrative-lab-collector","observation":{"share":"\\\\lab-server\\demo","relative_path":"demo.txt","access":"read","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1080","id":"T1080","name":"Taint Shared Content","domain":"enterprise","platforms":["Windows","SaaS","Linux","macOS","Office Suite"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1080","technique_page":"techniques/enterprise/T1080/","page":"detections/enterprise/T1080/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0471","name":"Detection of Tainted Content Written to Shared Storage","url":"https://attack.mitre.org/detectionstrategies/DET0471","stix_id":"x-mitre-detection-strategy--cdfe6166-43e9-434a-a961-139edd58ca0c","relationship_id":"relationship--f4069924-bd74-4ec0-a2ef-af02e966dcea","description":"","analytics":[{"id":"AN1298","name":"Analytic 1298","guidance":"Detects adversary tampering of shared directories via file drops (e.g., malicious LNK, EXE, VBS) followed by user execution or suspicious network activity.","url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1298","platforms":["Windows"],"tuning":[{"field":"SharedPathPrefix","description":"Defines monitored shared directories (e.g., \\\\server\\HR\\)."},{"field":"ExecutableExtensions","description":"Monitored file types dropped in shared paths (e.g., .lnk, .exe, .vbs)."}],"log_sources":[{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN1298","source_url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1298","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0102","component":"Network Share Access","name":"WinEventLog:Security","channel":"EventCode=5145","platforms":["Windows"],"analytic_id":"AN1298","source_url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1298","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0102/"}]},{"id":"AN1299","name":"Analytic 1299","guidance":"Detects script or binary modification within shared NFS/SMB directories followed by process execution from those paths.","url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1299","platforms":["Linux"],"tuning":[{"field":"MountPath","description":"Mount path of monitored shared volumes (e.g., /mnt/shared)."},{"field":"FilenamePattern","description":"Pattern matching of abnormal or disguised filenames."}],"log_sources":[{"component_id":"DC0061","component":"File Modification","name":"auditd:SYSCALL","channel":"write","platforms":["Linux"],"analytic_id":"AN1299","source_url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1299","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0102","component":"Network Share Access","name":"NSM:Flow","channel":"smb_files.log","platforms":["Linux"],"analytic_id":"AN1299","source_url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1299","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0102/"}]},{"id":"AN1300","name":"Analytic 1300","guidance":"Detects modification of shared network folders via .app bundles or scripting files with hidden extensions (e.g., double extensions like docx.app).","url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1300","platforms":["macOS"],"tuning":[{"field":"FileExtensionDeception","description":"Monitors use of hidden extensions or double extensions."},{"field":"TargetSharedFolder","description":"Defines sensitive shared folders (e.g., /Users/Shared/HR)."}],"log_sources":[{"component_id":"DC0039","component":"File Creation","name":"fs:fsevents","channel":"Directory events (kFSEventStreamEventFlagItemCreated)","platforms":["macOS"],"analytic_id":"AN1300","source_url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1300","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0061","component":"File Modification","name":"macos:unifiedlog","channel":"file writes","platforms":["macOS"],"analytic_id":"AN1300","source_url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1300","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]},{"id":"AN1301","name":"Analytic 1301","guidance":"Detects upload of malicious or unusual file types into cloud-shared folders, followed by user downloads or interactions.","url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1301","platforms":["SaaS"],"tuning":[{"field":"UserUploadRateThreshold","description":"Abnormal upload patterns into shared drives."},{"field":"MaliciousFileIndicator","description":"File hash or known-bad filename pattern matching."}],"log_sources":[{"component_id":"DC0039","component":"File Creation","name":"gcp:workspaceaudit","channel":"drive.activity logs","platforms":["SaaS"],"analytic_id":"AN1301","source_url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1301","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"},{"component_id":"DC0102","component":"Network Share Access","name":"m365:unified","channel":"FileUploaded, FileAccessed","platforms":["SaaS"],"analytic_id":"AN1301","source_url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1301","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0102/"}]},{"id":"AN1302","name":"Analytic 1302","guidance":"Detects embedded macros or scripts added to shared documents or use of external references to execute code.","url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1302","platforms":["Office Suite"],"tuning":[{"field":"MacroExecutionPolicy","description":"Controls macro execution based on user or group policy."},{"field":"SuspiciousKeywordMatch","description":"Regex match on suspicious VBA function names or calls."}],"log_sources":[{"component_id":"DC0061","component":"File Modification","name":"m365:defender","channel":"OfficeTelemetry or DLP","platforms":["Office Suite"],"analytic_id":"AN1302","source_url":"https://attack.mitre.org/detectionstrategies/DET0471#AN1302","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]}]}],"telemetry_references":[{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0102","name":"Network Share Access","tag":"Network Share Access","page":"telemetry/DC0102/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0132","name":"H1N1","url":"https://attack.mitre.org/software/S0132","kind":"malware","description":"[H1N1](https://attack.mitre.org/software/S0132) has functionality to copy itself to network shares.(Citation: Cisco H1N1 Part 2)","relationship_id":"relationship--1539eaf6-e4ea-4e9d-af2b-2594d1ca5b38","references":[{"source_name":"Cisco H1N1 Part 2","description":"Reynolds, J.. (2016, September 14). H1N1: Technical analysis reveals new capabilities – part 2. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20231210122239/https://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities-part-2"}]},{"id":"S0133","name":"Miner-C","url":"https://attack.mitre.org/software/S0133","kind":"malware","description":"[Miner-C](https://attack.mitre.org/software/S0133) copies itself into the public folder of Network Attached Storage (NAS) devices and infects new victims who open the file.(Citation: Softpedia MinerC)","relationship_id":"relationship--e0d33a40-a0d1-49fe-bea1-d0e4f000f628","references":[{"source_name":"Softpedia MinerC","description":"Cimpanu, C.. (2016, September 9). Cryptocurrency Mining Malware Discovered Targeting Seagate NAS Hard Drives. Retrieved September 12, 2024.","url":"https://news.softpedia.com/news/cryptocurrency-mining-malware-discovered-targeting-seagate-nas-hard-drives-508119.shtml"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--cd99a29c-0364-4d56-97ff-97542ff76fde","references":[{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0386","name":"Ursnif","url":"https://attack.mitre.org/software/S0386","kind":"malware","description":"[Ursnif](https://attack.mitre.org/software/S0386) has copied itself to and infected files in network drives for propagation.(Citation: TrendMicro Ursnif Mar 2015)(Citation: TrendMicro Ursnif File Dec 2014)","relationship_id":"relationship--f5faa97f-761c-4978-8535-2d9a42fcdd6f","references":[{"source_name":"TrendMicro Ursnif File Dec 2014","description":"Caragay, R. (2014, December 11). Info-Stealing File Infector Hits US, UK. Retrieved June 5, 2019.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/info-stealing-file-infector-hits-us-uk/"},{"source_name":"TrendMicro Ursnif Mar 2015","description":"Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.","url":"https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) can spread itself by infecting other portable executable files on networks shared drives.(Citation: Eset Ramsay May 2020)\t","relationship_id":"relationship--365f82e7-6fad-44a7-855d-955d4307920f","references":[{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}]},{"id":"S0575","name":"Conti","url":"https://attack.mitre.org/software/S0575","kind":"malware","description":"[Conti](https://attack.mitre.org/software/S0575) can spread itself by infecting other remote machines via network shared drives.(Citation: Cybereason Conti Jan 2021)(Citation: CarbonBlack Conti July 2020) ","relationship_id":"relationship--d9cb5add-4191-4c2e-bcde-25336748804c","references":[{"source_name":"Cybereason Conti Jan 2021","description":"Rochberger, L. (2021, January 12). Cybereason vs. Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware"},{"source_name":"CarbonBlack Conti July 2020","description":"Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) infects remote servers via network shares and by infecting WinCC database views with malicious code.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--e665a033-2893-43f5-ab5f-ba4c91636aba","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]}],"actors":[{"id":"G0012","name":"Darkhotel","url":"https://attack.mitre.org/groups/G0012","kind":"intrusion-set","description":"[Darkhotel](https://attack.mitre.org/groups/G0012) used a virus that propagates by infecting executables stored on shared drives.(Citation: Kaspersky Darkhotel)","relationship_id":"relationship--27b05a62-5310-40d9-9e49-b4dce3afad55","references":[{"source_name":"Kaspersky Darkhotel","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, November). The Darkhotel APT A Story of Unusual Hospitality. Retrieved November 12, 2014.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) has injected malicious macros into all Word and Excel documents on mapped network drives.(Citation: ESET Gamaredon June 2020)","relationship_id":"relationship--9b2ff8c9-3811-4615-a0c7-d79a14b7ade6","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}]},{"id":"G0060","name":"BRONZE BUTLER","url":"https://attack.mitre.org/groups/G0060","kind":"intrusion-set","description":"[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has placed malware on file shares and given it the same name as legitimate documents on the share.(Citation: Secureworks BRONZE BUTLER Oct 2017)","relationship_id":"relationship--bf160f02-ab07-4f2d-8625-5818833bb77f","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","description":"Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"id":"G1021","name":"Cinnamon Tempest","url":"https://attack.mitre.org/groups/G1021","kind":"intrusion-set","description":"[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) has deployed ransomware from a batch file in a network share.(Citation: Microsoft Ransomware as a Service)","relationship_id":"relationship--d0952afb-ce2a-43ee-bb6d-8daf90ebbd36","references":[{"source_name":"Microsoft Ransomware as a Service","description":"Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"id":"G1039","name":"RedCurl","url":"https://attack.mitre.org/groups/G1039","kind":"intrusion-set","description":"[RedCurl](https://attack.mitre.org/groups/G1039) has placed modified LNK files on network drives for lateral movement.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)","relationship_id":"relationship--29282003-9cf6-4cdf-b87d-92dfcf2b1d52","references":[{"source_name":"group-ib_redcurl1","description":"Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","description":"Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]}],"mitigations":[{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Protect shared folders by minimizing users who have write access.","relationship_id":"relationship--ecf9df35-e4f5-4041-a65d-0e897e5435b0","references":[]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Identify potentially malicious software that may be used to taint content or may result from it and audit and/or block the unknown programs by using application control (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)","relationship_id":"relationship--b0831323-de94-498a-8338-c60778bef95f","references":[{"source_name":"Beechey 2010","description":"Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.","url":"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"},{"source_name":"Corio 2008","description":"Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved September 12, 2024.","url":"https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"},{"source_name":"TechNet Applocker vs SRP","description":"Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.","url":"https://technet.microsoft.com/en-us/library/ee791851.aspx"},{"source_name":"NSA MS AppLocker","description":"NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.","url":"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"},{"source_name":"Windows Commands JPCERT","description":"Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.","url":"https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"}]},{"id":"M1049","name":"Antivirus/Antimalware","url":"https://attack.mitre.org/mitigations/M1049","kind":"course-of-action","description":"Anti-virus can be used to automatically quarantine suspicious files.(Citation: Mandiant Cloudy Logs 2023)","relationship_id":"relationship--a2bda2c9-b4cb-4a4c-9fce-f8efbab38fa6","references":[{"source_name":"Mandiant Cloudy Logs 2023","description":"Pany, D. & Hanley, C. (2023, May 3). Cloudy with a Chance of Bad Logs: Cloud Platform Log Configurations to Consider in Investigations. Retrieved October 16, 2023.","url":"https://www.mandiant.com/resources/blog/cloud-bad-log-configurations"}]},{"id":"M1050","name":"Exploit Protection","url":"https://attack.mitre.org/mitigations/M1050","kind":"course-of-action","description":"Use utilities that detect or mitigate common features used in exploitation, such as the Microsoft Enhanced Mitigation Experience Toolkit (EMET).","relationship_id":"relationship--f66af3ae-266c-4aa1-a6b4-f1ff87aff601","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1547.009":"/ttp-simulation/techniques/enterprise/T1547.009/","T1036":"/ttp-simulation/techniques/enterprise/T1036/","T1564.001":"/ttp-simulation/techniques/enterprise/T1564.001/","T1080":"/ttp-simulation/techniques/enterprise/T1080/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1080","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0102","collector":"illustrative-lab-collector","observation":{"share":"\\\\lab-server\\demo","relative_path":"demo.txt","access":"read","source_ip":"192.0.2.10"}}]}}