MITRE ATT&CK Technique
Description
Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally. A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses [Shortcut Modification](https://attack.mitre.org/techniques/T1547/009) of directory .LNK files that use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like the real directories, which are hidden through [Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001). The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts. (Citation: Retwin Directory Share Pivot) Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.
Supported Platforms
Created
April 29, 2026
Last Updated
April 29, 2026
STIX Data
{'created': '2017-05-31T21:31:01.759Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': '\n'
'Adversaries may deliver payloads to remote systems by adding '
'content to shared storage locations, such as network drives '
'or internal code repositories. Content stored on network '
'drives or in other shared locations may be tainted by adding '
'malicious programs, scripts, or exploit code to otherwise '
'valid files. Once a user opens the shared tainted content, '
"the malicious portion can be executed to run the adversary's "
'code on a remote system. Adversaries may use tainted shared '
'content to move laterally.\n'
'\n'
'A directory share pivot is a variation on this technique that '
'uses several other techniques to propagate malware when users '
'access a shared network directory. It uses [Shortcut '
'Modification](https://attack.mitre.org/techniques/T1547/009) '
'of directory .LNK files that use '
'[Masquerading](https://attack.mitre.org/techniques/T1036) to '
'look like the real directories, which are hidden through '
'[Hidden Files and '
'Directories](https://attack.mitre.org/techniques/T1564/001). '
'The malicious .LNK-based directories have an embedded command '
'that executes the hidden malware file in the directory and '
"then opens the real intended directory so that the user's "
'expected action still occurs. When used with frequently used '
'network directories, the technique may result in frequent '
'reinfections and broad access to systems and potentially to '
'new and higher privileged accounts. (Citation: Retwin '
'Directory Share Pivot)\n'
'\n'
'Adversaries may also compromise shared network directories '
'through binary infections by appending or prepending its code '
'to the healthy binary on the shared network directory. The '
'malware may modify the original entry point (OEP) of the '
'healthy binary to ensure that it is executed before the '
'legitimate code. The infection could continue to spread via '
'the newly infected file when it is executed by a remote '
'system. These infections may target both binary and '
'non-binary formats that end with extensions including, but '
'not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.',
'external_references': [{'external_id': 'T1080',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/techniques/T1080'},
{'description': 'Routin, D. (2017, November 13). '
'Abusing network shares for efficient '
'lateral movements and privesc '
'(DirSharePivot). Retrieved April 12, '
'2018.',
'source_name': 'Retwin Directory Share Pivot',
'url': 'https://rewtin.blogspot.ch/2017/11/abusing-user-shares-for-efficient.html'}],
'id': 'attack-pattern--246fd3c7-f5e3-466d-8787-4c13d9e3b61c',
'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
'phase_name': 'lateral-movement'}],
'modified': '2025-10-24T17:48:32.156Z',
'name': 'Taint Shared Content',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'attack-pattern',
'x_mitre_attack_spec_version': '3.2.0',
'x_mitre_contributors': ['Michal Dida, ESET', 'David Routin'],
'x_mitre_deprecated': False,
'x_mitre_detection': '',
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_is_subtechnique': False,
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_platforms': ['Windows', 'SaaS', 'Linux', 'macOS', 'Office Suite'],
'x_mitre_version': '1.6'}