T1080 Taint Shared Content: write then remote execution

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•1

Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.