T1080 Google Chronicle · YARA-L

Detect Taint Shared Content in Google Chronicle

Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Variants include the directory share pivot (planting malicious .LNK files that masquerade as legitimate directories), binary infection (prepending or appending code to legitimate executables on shares), and Office document macro injection (as seen with Gamaredon Group). Threat actors including Conti, Ursnif, Ramsay, InvisiMole, and RedCurl have all leveraged this technique for lateral movement.

MITRE ATT&CK

Tactic
Lateral Movement
Technique
T1080 Taint Shared Content
Canonical reference
https://attack.mitre.org/techniques/T1080/

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule t1080_taint_shared_content {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1080 Taint Shared Content — executables, scripts, LNK files, or macro-enabled Office documents written to UNC network paths or shared directory structures. Covers directory share pivot, binary planting, and Office macro injection patterns."
    mitre_attack_tactic = "Lateral Movement"
    mitre_attack_technique = "T1080"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.0"
    created = "2026-04-13"

  events:
    $e.metadata.event_type = "FILE_CREATION" or
    $e.metadata.event_type = "FILE_MODIFICATION"

    // UNC path or mapped share pattern
    (
      re.regex($e.target.file.full_path, `^\\\\`) or
      re.regex($e.target.file.full_path, `(?i)[A-Za-z]:\\.*\\(share|shares|public|users|common|docs|dept|data)\\`)
    )

    // Suspicious file extension
    re.regex($e.target.file.full_path, `(?i)\.(exe|dll|scr|bat|cmd|vbs|js|hta|ps1|lnk|docm|xlsm|pptm|doc|xls)$`)

    // Exclude known-safe initiating processes
    not re.regex($e.principal.process.file.full_path, `(?i)(MsMpEng\.exe|msiexec\.exe|TrustedInstaller\.exe|wuauclt\.exe|svchost\.exe)$`)

    $e.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    $risk_score = max(
      if(re.regex($e.target.file.full_path, `(?i)\.(exe|dll|scr)$`), 85,
      if(re.regex($e.target.file.full_path, `(?i)\.(docm|xlsm|pptm)$`), 80,
      if(re.regex($e.target.file.full_path, `(?i)\.lnk$`), 75, 65)))
    )
    $signal = if(
      re.regex($e.target.file.full_path, `(?i)\.(docm|xlsm|pptm|doc|xls)$`), "MacroOfficeOnShare",
      if(re.regex($e.target.file.full_path, `(?i)\.lnk$`), "LnkOnNetworkShare", "ExecOnNetworkShare")
    )
    $file_path = array_distinct($e.target.file.full_path)
    $initiating_process = array_distinct($e.principal.process.file.full_path)
    $user = array_distinct($e.principal.user.userid)

  condition:
    $e
}
high severity high confidence

Chronicle YARA-L 2.0 rule detecting T1080 Taint Shared Content across three sub-technique variants: executable/script planting on network shares, LNK directory share pivot, and macro-enabled Office document injection (Gamaredon pattern). Uses UDM FILE_CREATION and FILE_MODIFICATION events with path-based matching against UNC and mapped share patterns.

Data Sources

Google Chronicle UDMWindows Endpoint Telemetry via Chronicle forwarderSysmon via Chronicle ingestion

Required Tables

UDM events (FILE_CREATION, FILE_MODIFICATION)

False Positives & Tuning

  • Legitimate software packaging workflows where build systems publish release artifacts (DLLs, EXEs) directly to a network share staging area
  • Authorized red team or penetration testing activity on internal network shares that mirrors this exact TTP
  • Helpdesk or sysadmin tooling (PSTools, remote admin kits) that drops .bat or .ps1 scripts to administrative shares for remote execution
Download portable Sigma rule (.yml)

Other platforms for T1080

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Copy Malicious Executable to Network Share (Conti/Ursnif Pattern)

    Expected signal: Sysmon Event ID 11: TargetFilename=\\localhost\C$\Users\Public\svchost_update.exe, Image=cmd.exe or robocopy.exe/xcopy.exe. Sysmon Event ID 3: Network connection to localhost:445 from cmd.exe. Security Event ID 5145 on the target host: RelativeTargetName=Users\Public\svchost_update.exe, AccessMask including write/create. Security Event ID 5140: share \\*\C$ accessed.

  2. Test 2Plant Malicious LNK File on Network Share (Directory Share Pivot)

    Expected signal: Sysmon Event ID 11: TargetFilename=\\localhost\C$\Users\Public\Shared Documents.lnk, Image=powershell.exe. DeviceFileEvents: FileName=Shared Documents.lnk, FolderPath=\\localhost\C$\Users\Public\, ActionType=FileCreated. If a user clicks the .LNK: Sysmon Event ID 1 with Image=cmd.exe, CommandLine containing the embedded payload, ParentImage=explorer.exe.

  3. Test 3Inject Macro into Office Document on Network Share (Gamaredon Pattern)

    Expected signal: Sysmon Event ID 11: TargetFilename=\\localhost\C$\Users\Public\Q1_Budget_Review.docm, Image=powershell.exe. DeviceFileEvents: FileName=Q1_Budget_Review.docm, FolderPath starts with \\, ActionType=FileCreated. Security Event 5145 with RelativeTargetName=Users\Public\Q1_Budget_Review.docm and write access.

  4. Test 4Bulk Executable Spreading Across Multiple Shares (Worm Propagation Simulation)

    Expected signal: Two Sysmon Event ID 11 entries: both with Image=cmd.exe and TargetFilename pointing to separate UNC share paths. Two Security Event 5145 entries on localhost for write to .exe on each share. DeviceFileEvents: two FileCreated events with distinct FolderPath values (different share names) from the same InitiatingProcessFileName within seconds.

Last updated: 2026-04-13 Research depth: deep
References (10)

Unlock Pro Content

Get the full detection package for T1080 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Related Techniques

T1021.002SMB/Windows Admin SharesT1547.009Shortcut ModificationT1036MasqueradingT1564.001Hidden Files and DirectoriesT1091Replication Through Removable MediaT1105Ingress Tool TransferT1204.002Malicious FileT1566.001Spearphishing AttachmentT1570Lateral Tool TransferT1083File and Directory Discovery

Same Tactic: Lateral Movement

Popular Detections