TA0008 · LATERAL MOVEMENT
Taint Shared Content
Planting malicious files or shortcuts on network shares so other users execute them.
Detect it with
New executables and .lnk files on shares, followed by execution from a UNC path on multiple hosts.
Why it matters on shift
Taint Shared Content is one of the concrete ways adversaries achieve lateral movement. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After lateral movement, the next tactic is usually Collection. Search your telemetry for the transition before closing the ticket.
Kill-chain context