Shared folders feel safe because everyone trusts them. MITRE ATT&CK Taint Shared Content (T1080) is about abusing that trust. It sits in the lateral movement tactic and applies to Windows, SaaS, Linux, macOS and Office Suite.
How attackers use it
MITRE says adversaries may deliver payloads to remote systems by adding content to shared storage, such as network drives or internal code repositories. Malicious programs, scripts or exploit code may be added to otherwise valid files. When a user opens the tainted content, the malicious part can run on that user's machine, and the adversary can use this to move laterally.
MITRE describes two variations:
- Directory share pivot. Shortcut files that look like real directories are placed in a share, and the real directories are hidden. The shortcut carries a command that runs a hidden file and then opens the real directory, so the user sees what they expected. MITRE notes that on frequently used shares this can cause repeated reinfection and broad access, possibly to higher privileged accounts.
- Binary infection. Code is added to the start or end of a healthy binary on a share, and the entry point may be changed so the added code runs first. The infected file can continue to spread when other systems run it.
The internal code repository case matters for software teams. A repository that many developers pull from is shared content too.
How to detect it
MITRE's strategy (DET0471) lists analytics per platform:
- Windows: tampering with shared directories through file drops such as malicious LNK, EXE or VBS files, followed by user execution or suspicious network activity.
- Linux: script or binary modification within shared NFS or SMB directories, followed by process execution from those paths.
- macOS: changes to shared folders through app bundles or scripting files with hidden extensions, such as double extensions.
- SaaS and Office Suite: unusual file types uploaded to cloud shared folders followed by downloads or interaction, and macros, scripts or external references added to shared documents.
Auditing write events on high traffic shares gives the best early signal. Few people should be writing executables to a shared directory.
How to reduce the risk
- Protect shared folders by minimizing the users who have write access (Restrict File and Directory Permissions).
- Use application control tools such as AppLocker, or Software Restriction Policies where appropriate, to audit or block unknown programs (Execution Prevention).
- Use antivirus to automatically quarantine suspicious files (Antivirus/Antimalware).
- Use utilities that detect or mitigate common exploitation features (Exploit Protection).
Check your own environment
- Which shares are writable by everyone, and why?
- Is file auditing turned on for shares that hold scripts and installers?
- Who can push to your internal repositories, and are changes reviewed before others pull them?
On Windows, a read-only list of shares on a file server:
net share
Try it yourself
Provenance records help show that what a team runs is what was built. This demo walks through attestation and provenance.
Click through it at your own pace, or open it full screen.
Quick check
What is the single most direct mitigation MITRE lists for shared folders?
Minimizing the number of users who have write access to them.
Sources
- MITRE ATT&CK, T1080 Taint Shared Content: https://attack.mitre.org/techniques/T1080/
