Windows shortcut files look like simple pointers. They also carry a lot of metadata, and attackers have found places in it to tuck a download address.
MITRE tracks this as LNK Icon Smuggling, technique T1027.012, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Windows.
How attackers use it
A .LNK file includes an icon location field, known as the IconEnvironmentDataBlock, that tells Windows where to find the icon to display. Adversaries put a path to an external URL there. When the shortcut is opened, the referenced payload may be downloaded.
The shortcut's target field can then run the downloaded file using a command and scripting interpreter or a system binary proxy execution argument. MITRE notes this has been used in phishing, and also after compromise, when a malicious script runs an LNK on an infected host to pull more payloads.
How to detect it
MITRE's strategy (DET0405) correlates LNK execution with embedded resource extraction or suspicious network activity right after launch. Practical angles:
- A shortcut file that triggers an outbound web request when it is opened.
- A shortcut that launches an interpreter or a binary used as a proxy for execution.
- Shortcuts arriving in email or archive attachments, which should be rare for most users.
How to reduce the risk
MITRE lists two mitigations.
- Antivirus and antimalware. Use signatures or heuristics to detect malicious LNK files and the files they download.
- Behavior prevention on endpoint. On Windows 10, enable Attack Surface Reduction rules to prevent execution of potentially obfuscated scripts or payloads.
Also consider blocking .lnk files at the mail gateway, since few legitimate messages need to carry one.
Quick check
Which shortcut field is abused in this technique?
The icon location field, called the IconEnvironmentDataBlock, which is meant to point to an icon file but can point to an external URL.
Sources
- MITRE ATT&CK, LNK Icon Smuggling (T1027.012)
