Taint Shared Content (ATT&CK T1080) places content in a shared storage location where another user or system may later access it. The technique can involve modifying or adding malicious files and can enable lateral movement. This entry's command is a harmless, authorized validation of write access only; it does not execute a payload. Office Trusted Locations are a separate, configuration-dependent feature and are not required for T1080.
Variant:
Copy an assessment file to a POSIX host
powershell
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER