Taint Shared Content
Technique · ATTACK:enterprise:T1080
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1080",
"title": "Taint Shared Content",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1080",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--246fd3c7-f5e3-466d-8787-4c13d9e3b61c",
"external_id": "T1080",
"domain": "enterprise",
"created": "2017-05-31T21:31:01.759Z",
"modified": "2025-10-24T17:48:32.156Z",
"version": "1.6",
"aliases": [
],
"tactics": [
"lateral-movement"
],
"source_references": [
{
"source_name": "Retwin Directory Share Pivot",
"url": "https://rewtin.blogspot.ch/2017/11/abusing-user-shares-for-efficient.html"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0132 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1539eaf6-e4ea-4e9d-af2b-2594d1ca5b38
Cisco H1N1 Part 2ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27b05a62-5310-40d9-9e49-b4dce3afad55
Kaspersky DarkhotelATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29282003-9cf6-4cdf-b87d-92dfcf2b1d52
group-ib_redcurl1 · group-ib_redcurl2ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--365f82e7-6fad-44a7-855d-955d4307920f
Eset Ramsay May 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b2ff8c9-3811-4615-a0c7-d79a14b7ade6
ESET Gamaredon June 2020ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2bda2c9-b4cb-4a4c-9fce-f8efbab38fa6
Mandiant Cloudy Logs 2023ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0831323-de94-498a-8338-c60778bef95f
Beechey 2010 · Corio 2008 · TechNet Applocker vs SRP · NSA MS AppLocker · Windows Commands JPCERTATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf160f02-ab07-4f2d-8625-5818833bb77f
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd99a29c-0364-4d56-97ff-97542ff76fde
ESET InvisiMole June 2020ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0952afb-ce2a-43ee-bb6d-8daf90ebbd36
Microsoft Ransomware as a ServiceATTACK:enterprise:S0575 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9cb5add-4191-4c2e-bcde-25336748804c
Cybereason Conti Jan 2021 · CarbonBlack Conti July 2020ATTACK:enterprise:S0133 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0d33a40-a0d1-49fe-bea1-d0e4f000f628
Softpedia MinerCATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e665a033-2893-43f5-ab5f-ba4c91636aba
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ecf9df35-e4f5-4041-a65d-0e897e5435b0
ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5faa97f-761c-4978-8535-2d9a42fcdd6f
TrendMicro Ursnif File Dec 2014 · TrendMicro Ursnif Mar 2015ATTACK:enterprise:M1050 → mitigates → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f66af3ae-266c-4aa1-a6b4-f1ff87aff601