Taint Shared Content
Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Variants include the directory share pivot (planting malicious .LNK files that masquerade as legitimate directories), binary infection (prepending or appending code to legitimate executables on shares), and Office document macro injection (as seen with Gamaredon Group). Threat actors including Conti, Ursnif, Ramsay, InvisiMole, and RedCurl have all leveraged this technique for lateral movement.
What is T1080 Taint Shared Content?
Taint Shared Content (T1080) maps to the Lateral Movement tactic — the adversary is trying to move through your environment in MITRE ATT&CK.
This page provides production-ready detection logic for Taint Shared Content, covering the data sources and telemetry it touches: File: File Creation, File: File Modification, Microsoft Defender for Endpoint, Network Share: Network Share Access. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Lateral Movement
- Technique
- T1080 Taint Shared Content
- Canonical reference
- https://attack.mitre.org/techniques/T1080/
let SuspiciousExtensions = dynamic([".exe", ".dll", ".scr", ".bat", ".cmd", ".vbs", ".js", ".hta", ".ps1", ".lnk"]);
let KnownSafeSources = dynamic(["MsMpEng.exe", "msiexec.exe", "TrustedInstaller.exe", "wuauclt.exe", "svchost.exe"]);
// Signal 1: Executable or script written to a UNC network path
let ExecOnShare = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FolderPath startswith @"\\\\"
| extend FileExt = tolower(tostring(split(FileName, ".")[-1]))
| where strcat(".", FileExt) in~ (SuspiciousExtensions)
| where InitiatingProcessFileName !in~ (KnownSafeSources)
| extend Signal = "ExecOnNetworkShare";
// Signal 2: LNK file creation on a mapped or UNC share path (directory share pivot)
let LnkOnShare = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FileName endswith ".lnk" or FileName endswith ".LNK"
| where FolderPath startswith @"\\\\" or FolderPath matches regex @"[A-Z]:\\.*\\(share|shares|public|users|common|docs|dept|data)"
| where InitiatingProcessFileName !in~ (KnownSafeSources)
| extend Signal = "LnkOnNetworkShare";
// Signal 3: Office document with macro-enabled extension written to a network share (Gamaredon pattern)
let OfficeOnShare = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified")
| where FileName endswith ".docm" or FileName endswith ".xlsm" or FileName endswith ".pptm"
or FileName endswith ".doc" or FileName endswith ".xls"
| where FolderPath startswith @"\\\\"
| where InitiatingProcessFileName !in~ (KnownSafeSources)
| extend Signal = "MacroOfficeOnShare";
// Combine signals
union ExecOnShare, LnkOnShare, OfficeOnShare
| extend FileExt = tolower(tostring(split(FileName, ".")[-1]))
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, FileExt, Signal,
InitiatingProcessFileName, InitiatingProcessCommandLine,
InitiatingProcessAccountName, InitiatingProcessId
| sort by Timestamp descDetects three variants of T1080 Taint Shared Content using Microsoft Defender for Endpoint DeviceFileEvents. Signal 1 catches executable and script files written to UNC network paths (\\server\share), covering Conti/Ursnif binary spreading. Signal 2 catches .LNK files created on network shares, covering the RedCurl/directory-share-pivot pattern. Signal 3 catches macro-enabled Office documents written to shares, covering the Gamaredon macro injection pattern. Filters exclude well-known system processes (MsMpEng, msiexec, TrustedInstaller) to reduce noise from legitimate software deployments.
Data Sources
Required Tables
False Positives
- Software deployment via SCCM or PDQ Deploy copying installation packages (.exe, .msi) to deployment shares
- Backup agents or robocopy jobs replicating executables to archive network shares
- IT administrators legitimately copying scripts (.ps1, .bat) to shared script repositories or SYSVOL for GPO deployment
- Antivirus or EDR updates propagating via network share to air-gapped or slow-update endpoints
- DFS replication (DFSR) synchronizing executables and documents across site shares
- Development teams pushing compiled binaries to network-accessible build output directories
Sigma rule & cross-platform mapping
The detection logic for Taint Shared Content (T1080) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: network_connection
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for T1080
References (8)
- https://attack.mitre.org/techniques/T1080/
- https://rewtin.blogspot.ch/2017/11/abusing-user-shares-for-efficient.html
- https://www.group-ib.com/resources/threat-research/red-curl.html
- https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/
- https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/
- https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1080/T1080.md
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Copy Malicious Executable to Network Share (Conti/Ursnif Pattern)
Expected signal: Sysmon Event ID 11: TargetFilename=\\localhost\C$\Users\Public\svchost_update.exe, Image=cmd.exe or robocopy.exe/xcopy.exe. Sysmon Event ID 3: Network connection to localhost:445 from cmd.exe. Security Event ID 5145 on the target host: RelativeTargetName=Users\Public\svchost_update.exe, AccessMask including write/create. Security Event ID 5140: share \\*\C$ accessed.
- Test 2Plant Malicious LNK File on Network Share (Directory Share Pivot)
Expected signal: Sysmon Event ID 11: TargetFilename=\\localhost\C$\Users\Public\Shared Documents.lnk, Image=powershell.exe. DeviceFileEvents: FileName=Shared Documents.lnk, FolderPath=\\localhost\C$\Users\Public\, ActionType=FileCreated. If a user clicks the .LNK: Sysmon Event ID 1 with Image=cmd.exe, CommandLine containing the embedded payload, ParentImage=explorer.exe.
- Test 3Inject Macro into Office Document on Network Share (Gamaredon Pattern)
Expected signal: Sysmon Event ID 11: TargetFilename=\\localhost\C$\Users\Public\Q1_Budget_Review.docm, Image=powershell.exe. DeviceFileEvents: FileName=Q1_Budget_Review.docm, FolderPath starts with \\, ActionType=FileCreated. Security Event 5145 with RelativeTargetName=Users\Public\Q1_Budget_Review.docm and write access.
- Test 4Bulk Executable Spreading Across Multiple Shares (Worm Propagation Simulation)
Expected signal: Two Sysmon Event ID 11 entries: both with Image=cmd.exe and TargetFilename pointing to separate UNC share paths. Two Security Event 5145 entries on localhost for write to .exe on each share. DeviceFileEvents: two FileCreated events with distinct FolderPath values (different share names) from the same InitiatingProcessFileName within seconds.
Response Playbook
Triage
- Identify the file written to the share: what is the filename, extension, and SHA256 hash? Check the hash against VirusTotal or your threat intel platform immediately — this is the fastest way to confirm or rule out a known malicious payload.
- Identify the writing process: which process created or modified the file (InitiatingProcessFileName / Image)? Is this a known software deployment agent (sccm, pdq, robocopy) or an unexpected process (explorer.exe, word.exe, powershell.exe, cmd.exe)?
- Identify the user context: what account performed the write? Is it a service account, domain admin, or a regular end-user? A regular user writing executables to shared drives is a strong indicator of compromise or worm propagation.
- Scope the share: what share was targeted (e.g., \\server\department, \\dc\SYSVOL, \\server\software)? High-value shares like SYSVOL, NETLOGON, or department-wide shares indicate higher impact if tainted.
- Check for spread: has the same file hash or filename appeared on other network shares or other endpoints? Query DeviceFileEvents for the same FileName or InitiatingProcessFileName across the environment in the last 48h.
- For .LNK files: resolve the .LNK target using LNK parsing tools or Sysmon's ProcessCreate events on the host that created it. Malicious .LNK files typically point to UNC paths with embedded execution commands (e.g., cmd.exe /c start malware.exe && explorer.exe \\share\legit_folder).
- For Office documents: check if the document was opened on another endpoint after it appeared on the share — look for WINWORD.EXE or EXCEL.EXE spawning child processes (cmd.exe, powershell.exe, wscript.exe) on other machines.
Containment
- Immediately quarantine or delete the tainted file from the network share — don't just rename it, as some malware monitors for deletion and restores files. If possible, take a copy for forensics first.
- Identify and isolate the source endpoint (the host that wrote the tainted content) using EDR network isolation or emergency VLAN assignment to stop further share poisoning.
- Revoke write access to the affected share temporarily and convert it to read-only via share ACLs while the investigation proceeds — this prevents the tainted file from being replaced if the attacker still has access.
- Identify all users who accessed the share after the tainted file was written (Security Event ID 5145, 5140) and check those endpoints for lateral compromise — anyone who opened the file may now be a secondary victim.
- If Office macro injection is confirmed (Gamaredon pattern): block macro execution via GPO or Intune (disable macros in Office Trust Center for all files from network locations) across the environment immediately.
- Reset credentials for the compromised account that wrote the tainted content. If it's a service account or domain admin, initiate full credential rotation per your IR runbook.
- Search for the same payload on all accessible shares using endpoint telemetry or a scheduled script — malware like Conti and Ursnif systematically enumerate and infect all reachable shares.
Evidence Collection
- File system: collect the tainted file itself for malware analysis. Preserve timestamps (creation, modification, access) and record the SHA256 hash. Use robocopy with /COPYALL to preserve all timestamps.
- Sysmon Event ID 11 (FileCreate): captures TargetFilename, Image, ProcessId, User, CreationUtcTime — primary telemetry for this technique.
- Sysmon Event ID 1 (Process Create): captures the command line of the writing process. Important if the write was initiated by cmd.exe, powershell.exe, or a scripted worm process.
- Windows Security Event ID 5145 (Detailed File Share Audit): records which accounts accessed which files on which shares with which access masks — requires audit policy 'Audit Detailed File Share' to be enabled.
- Windows Security Event ID 5140 (Network Share Object Access): records share-level access (less granular than 5145 but enabled by default on some configurations).
- LNK file forensics: if .LNK files were planted, parse them with tools like LECmd (Eric Zimmerman) or lnk-parser to extract embedded target path, working directory, command arguments, and timestamps.
- Office document forensics: if macro-infected documents are found, extract macros using olevba (oletools) or ViperMonkey for static analysis of the VBA payload without executing it.
- MFT artifacts: collect the $MFT from the file server hosting the share to get authoritative creation/modification timestamps for the tainted files.
Escalation Criteria
- ! The tainted file hash matches a known ransomware dropper, wiper, or RAT (e.g., Conti, Ramsay, Ursnif) — escalate immediately to IR team and begin full incident response.
- ! Multiple shares across multiple servers have been tainted by the same payload — indicates active worm propagation or an automated lateral movement tool, requiring broad network containment.
- ! A domain admin or service account was used to write the tainted content — privileged account compromise significantly expands blast radius.
- ! The .LNK file or tainted executable has already been executed on one or more remote endpoints (child process spawned from the share path) — the attack is actively spreading.
- ! Evidence of SYSVOL or NETLOGON share targeting — these shares are accessed by every domain-joined machine during logon, making this a potential domain-wide compromise vector.
- ! The writing process is a legitimate business application (Word, Excel, Explorer) that was compromised to propagate the payload via macro or dropper — this indicates a multi-stage attack with prior endpoint compromise.
- ! Network connections from infected endpoints to external C2 infrastructure following file execution on the share — confirms active post-exploitation, not just lateral staging.
Investigation Guide
Forensic Artifacts
- >
File System: \\<server>\<share>\ — examine creation/modification timestamps for recently added executables, scripts, or .LNK files; compare against baseline if available. - >
Windows Security Event Log: Event ID 5145 on the file server — records per-file access attempts on shares with user, IP, access mask, and relative target name. - >
Windows Security Event Log: Event ID 5140 on the file server — records share-level access (coarser than 5145, useful when detailed share auditing is not enabled). - >
Sysmon Event ID 11 on the source endpoint — TargetFilename will show the UNC path where the file was written, Image shows the process that wrote it. - >
Sysmon Event ID 1 on destination endpoints — if the tainted file was executed, this captures the command line and parent process context. - >
LNK file internals (if directory share pivot): %APPDATA%\Microsoft\Windows\Recent\ on endpoints that browsed the share — recently accessed .LNK files are tracked here. - >
Office Document VBA macros: oletools / olevba output showing macro content, auto-execution triggers (Document_Open, AutoOpen, Workbook_Open), and any embedded URLs or shell commands. - >
Prefetch files on endpoints that executed tainted binaries: C:\Windows\Prefetch\<TAINTED_FILENAME>.EXE-*.pf — confirms execution and timestamps. - >
Registry: HKCU\Software\Microsoft\Office\<version>\<App>\Security\AccessVBOM — if set to 1, VBA was allowed to access the VBA project model (indicator of macro infection infrastructure). - >
NTFS $MFT on the file server: authoritative record of file creation/modification times, hard link counts, and file sizes for all files in the tainted share directory.
Tuning Guidance
The most common source of false positives is legitimate software deployment infrastructure. Baseline your environment by running the detection in audit mode for 7 days and collecting all InitiatingProcessFileName + AccountName combinations that write executables to shares. Build an allowlist of known-good tuples: (source_host, process, account, target_share). SCCM Distribution Points, PDQ Deploy servers, and IT admin shares will dominate the noise. For the Security Event 5145 signal, ensure 'Audit Detailed File Share' is enabled via GPO (Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Object Access > Audit Detailed File Share) — without it, the SPL share write signal will not fire. For the directory share pivot hunt, additional tuning may be needed in environments where IT teams legitimately deploy .LNK shortcut files alongside binaries in shared software repositories. Increase fidelity by correlating the .LNK target path parsing: legitimate .LNK files deployed by IT typically point to local paths, while malicious .LNK files in directory share pivots point to UNC paths with embedded command arguments. Consider enabling Windows Defender Attack Surface Reduction (ASR) rule 'Block untrusted and unsigned processes that run from USB' and extending it to network share paths via Microsoft Defender for Endpoint custom indicators.
Hunting Queries
Hunt for executables that were launched directly from UNC network share paths (\\server\share\...) across multiple endpoints. A single binary executing from a share path on more than one host is a strong indicator of successful tainted share spread — covering Conti, Ursnif, and Ramsay propagation patterns.
// Hunt: endpoints that EXECUTED files from network share paths (confirmed infection spread)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FolderPath startswith @"\\\\"
| where FileName endswith ".exe" or FileName endswith ".scr" or FileName endswith ".bat" or FileName endswith ".cmd" or FileName endswith ".hta"
| where InitiatingProcessFileName !in~ ("explorer.exe", "msiexec.exe", "svchost.exe")
or (InitiatingProcessFileName =~ "explorer.exe" and FolderPath startswith @"\\\\")
| summarize ExecutionCount=count(), UniqueHosts=dcount(DeviceName), Hosts=make_set(DeviceName, 10),
Earliest=min(Timestamp), Latest=max(Timestamp)
by FileName, FolderPath, SHA256
| where UniqueHosts > 1
| sort by UniqueHosts descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval Image=lower(Image)
| eval CurrentDirectory=lower(CurrentDirectory)
| where like(CurrentDirectory, "\\\\%") OR like(Image, "\\\\%")
| eval FileExt=mvindex(split(Image, "."), -1)
| where match(FileExt, "^(exe|scr|bat|cmd|hta)$")
| stats count as ExecutionCount, dc(host) as UniqueHosts, values(host) as Hosts,
earliest(_time) as Earliest, latest(_time) as Latest
by Image, CurrentDirectory, Hashes
| where UniqueHosts > 1
| sort - UniqueHostsHunt for single processes that write executables or macro-enabled documents to multiple network shares in a short window. This pattern mirrors worm propagation behavior seen with Conti (infects all reachable shares), Ursnif (copies itself to drive shares), and Gamaredon (injects macros into all Office docs on mapped drives). High FileCount or UniqueShares from a non-administrative process is highly suspicious.
// Hunt: rapid sequential file writes to network shares from one process (worm-like spreading behavior)
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath startswith @"\\\\"
| extend FileExt = tolower(tostring(split(FileName, ".")[-1]))
| where strcat(".", FileExt) in~ (dynamic([".exe", ".dll", ".bat", ".vbs", ".ps1", ".docm", ".xlsm", ".lnk"]))
| summarize FileCount=count(), UniqueShares=dcount(tostring(split(FolderPath, "\\")[2])),
Shares=make_set(tostring(split(FolderPath, "\\")[2]), 10),
Files=make_set(FileName, 20), Earliest=min(Timestamp), Latest=max(Timestamp)
by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName
| where FileCount > 5 or UniqueShares > 2
| sort by UniqueShares desc, FileCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval TargetFilename=lower(TargetFilename)
| where like(TargetFilename, "\\\\%")
| eval FileExt=mvindex(split(TargetFilename, "."), -1)
| where match(FileExt, "^(exe|dll|bat|vbs|ps1|docm|xlsm|lnk)$")
| eval ShareServer=mvindex(split(TargetFilename, "\\"), 2)
| stats count as FileCount, dc(ShareServer) as UniqueShares,
values(ShareServer) as Shares, values(TargetFilename) as Files,
earliest(_time) as Earliest, latest(_time) as Latest
by host, Image, User
| where FileCount > 5 OR UniqueShares > 2
| sort - UniqueShares FileCountHunt for the co-occurrence of .LNK files and executables written to the same directory on a network share within a 30-minute window. This bi-lateral pattern is the hallmark of the directory share pivot technique (referenced in Retwin research and used by RedCurl): the attacker plants a hidden malicious binary alongside a malicious .LNK file that masquerades as the legitimate directory to lure users into executing the malware.
// Hunt: hidden directory + LNK file pair on same share path (directory share pivot indicator)
let LnkFiles = DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileCreated", "FileModified")
| where FileName endswith ".lnk"
| where FolderPath startswith @"\\\\"
| project LnkTimestamp=Timestamp, DeviceName, LnkPath=FolderPath, LnkFile=FileName,
WritingProcess=InitiatingProcessFileName, WritingAccount=InitiatingProcessAccountName;
let HiddenFiles = DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType in ("FileCreated", "FileModified")
| where FolderPath startswith @"\\\\"
| where FileName endswith ".exe" or FileName endswith ".bat" or FileName endswith ".scr"
| project HiddenTimestamp=Timestamp, DeviceName, HiddenPath=FolderPath, HiddenFile=FileName;
LnkFiles
| join kind=inner HiddenFiles on DeviceName
| where LnkPath == HiddenPath
| where abs(datetime_diff('minute', LnkTimestamp, HiddenTimestamp)) < 30
| project LnkTimestamp, HiddenTimestamp, DeviceName, LnkPath, LnkFile, HiddenFile, WritingProcess, WritingAccount
| sort by LnkTimestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| eval TargetFilename=lower(TargetFilename)
| where like(TargetFilename, "\\\\%")
| eval FileExt=mvindex(split(TargetFilename, "."), -1)
| eval FileDir=substr(TargetFilename, 1, len(TargetFilename) - len(mvindex(split(TargetFilename, "\\"), -1)) - 1)
| eval IsLnk=if(FileExt="lnk", 1, 0)
| eval IsExec=if(match(FileExt, "^(exe|bat|scr|cmd)$"), 1, 0)
| stats sum(IsLnk) as LnkCount, sum(IsExec) as ExecCount,
values(eval(if(IsLnk=1, TargetFilename, null()))) as LnkFiles,
values(eval(if(IsExec=1, TargetFilename, null()))) as ExecFiles,
earliest(_time) as Earliest, latest(_time) as Latest
by host, FileDir, User
| where LnkCount > 0 AND ExecCount > 0
| sort - LnkCountAtomic Red Team Tests
Simulates an adversary copying a payload binary to a writable network share — the mechanism used by Conti ransomware and Ursnif to propagate across environments. Uses a benign calc.exe copy renamed to a plausible filename to test detection without executing malware. Requires an accessible writable share.
Command
net use Z: \\localhost\C$ /persistent:no
copy C:\Windows\System32\calc.exe Z:\Users\Public\svchost_update.exe
net use Z: /deleteCleanup
del \\localhost\C$\Users\Public\svchost_update.exe 2>nul
net use Z: /delete 2>nulExpected Telemetry
Sysmon Event ID 11: TargetFilename=\\localhost\C$\Users\Public\svchost_update.exe, Image=cmd.exe or robocopy.exe/xcopy.exe. Sysmon Event ID 3: Network connection to localhost:445 from cmd.exe. Security Event ID 5145 on the target host: RelativeTargetName=Users\Public\svchost_update.exe, AccessMask including write/create. Security Event ID 5140: share \\*\C$ accessed.
Expected Detection
KQL Signal 1 fires on ExecOnNetworkShare: FileName=svchost_update.exe, FolderPath=\\localhost\C$\Users\Public\. SPL Signal 1 fires on Sysmon EventCode=11 with UNC path and .exe extension. Security Event 5145 signal fires on write access to .exe file on admin share.
Simulates the RedCurl and directory share pivot technique by creating a malicious .LNK file on a network share that embeds a hidden command execution before opening the legitimate folder. The planted .LNK file appears to be a directory but executes cmd.exe with a benign echo command as its payload. This matches the exact pattern described in the Retwin Directory Share Pivot research.
Command
$WshShell = New-Object -ComObject WScript.Shell
$SharePath = "\\localhost\C$\Users\Public"
$LnkPath = "$SharePath\Shared Documents.lnk"
$Shortcut = $WshShell.CreateShortcut($LnkPath)
$Shortcut.TargetPath = "cmd.exe"
$Shortcut.Arguments = '/c echo df00tech-test > %TEMP%\lnk_test.txt && start explorer.exe \\localhost\C$\Users\Public\Real_Documents'
$Shortcut.IconLocation = "%SystemRoot%\System32\shell32.dll,3"
$Shortcut.WindowStyle = 7
$Shortcut.Save()
Write-Host "LNK planted at $LnkPath"Cleanup
Remove-Item "\\localhost\C$\Users\Public\Shared Documents.lnk" -ErrorAction SilentlyContinue
Remove-Item "$env:TEMP\lnk_test.txt" -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 11: TargetFilename=\\localhost\C$\Users\Public\Shared Documents.lnk, Image=powershell.exe. DeviceFileEvents: FileName=Shared Documents.lnk, FolderPath=\\localhost\C$\Users\Public\, ActionType=FileCreated. If a user clicks the .LNK: Sysmon Event ID 1 with Image=cmd.exe, CommandLine containing the embedded payload, ParentImage=explorer.exe.
Expected Detection
KQL Signal 2 fires on LnkOnNetworkShare: FileName ends with .lnk, FolderPath starts with \\. SPL Signal 1 fires on EventCode=11 with UNC path and .lnk extension. Directory share pivot hunt fires if a co-located executable was also written within 30 minutes.
Simulates the Gamaredon Group technique of writing macro-enabled Office documents to network shares mapped by the victim. Creates a .docm file (Word macro-enabled document) on a network share path using PowerShell file writes, mimicking a malware implant that enumerates mapped drives and replaces/creates macro-laced Office files. The document content is benign XML — no macro is actually functional.
Command
$SharePath = "\\localhost\C$\Users\Public"
$DocmPath = "$SharePath\Q1_Budget_Review.docm"
$BenignDocm = [System.IO.File]::ReadAllBytes("C:\Windows\System32\notepad.exe") # placeholder bytes
# Create a minimal OOXML stub (not executable, purely for telemetry)
[System.IO.File]::WriteAllText($DocmPath, "PK stub - df00tech test docm for T1080 detection validation")
Write-Host "Macro-enabled doc written to share: $DocmPath"Cleanup
Remove-Item "\\localhost\C$\Users\Public\Q1_Budget_Review.docm" -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 11: TargetFilename=\\localhost\C$\Users\Public\Q1_Budget_Review.docm, Image=powershell.exe. DeviceFileEvents: FileName=Q1_Budget_Review.docm, FolderPath starts with \\, ActionType=FileCreated. Security Event 5145 with RelativeTargetName=Users\Public\Q1_Budget_Review.docm and write access.
Expected Detection
KQL Signal 3 fires on MacroOfficeOnShare: FileName ending .docm, FolderPath=\\localhost\C$\Users\Public\. SPL MacroOfficeOnShare signal fires on EventCode=11 with UNC path and .docm extension. Bulk file hunt may fire if this is repeated across multiple documents.
Simulates the rapid multi-share spread behavior of worms like Conti and Ramsay by writing a benign executable (a copy of calc.exe) to multiple distinct network share paths in rapid succession. This tests detection of worm-like lateral spreading velocity — a single process writing executables to many unique shares within a short time window.
Command
# Create test shares (requires local admin)
net share TestShare1=C:\Temp\share1 /grant:Everyone,FULL 2>nul
net share TestShare2=C:\Temp\share2 /grant:Everyone,FULL 2>nul
mkdir C:\Temp\share1 2>nul
mkdir C:\Temp\share2 2>nul
# Simulate spreading
copy C:\Windows\System32\calc.exe \\localhost\TestShare1\svc_updater.exe
copy C:\Windows\System32\calc.exe \\localhost\TestShare2\svc_updater.exe
Write-Host "Simulated worm spread to 2 shares"Cleanup
del \\localhost\TestShare1\svc_updater.exe 2>nul
del \\localhost\TestShare2\svc_updater.exe 2>nul
net share TestShare1 /delete 2>nul
net share TestShare2 /delete 2>nul
rmdir /s /q C:\Temp\share1 2>nul
rmdir /s /q C:\Temp\share2 2>nulExpected Telemetry
Two Sysmon Event ID 11 entries: both with Image=cmd.exe and TargetFilename pointing to separate UNC share paths. Two Security Event 5145 entries on localhost for write to .exe on each share. DeviceFileEvents: two FileCreated events with distinct FolderPath values (different share names) from the same InitiatingProcessFileName within seconds.
Expected Detection
KQL worm hunting query fires: same InitiatingProcessFileName writing to multiple shares (UniqueShares > 2 or FileCount > 5). SPL bulk spread hunt fires with FileCount >= 2 and UniqueShares >= 2 from same host and process. Primary detection KQL Signal 1 fires twice (once per share write).