A Windows shortcut is just a pointer to another file or program. That makes it a handy place to hide a launch instruction. MITRE tracks this as T1547.009, Shortcut Modification, with Persistence and Privilege Escalation as the tactics.
How attackers use it
MITRE describes shortcuts used to execute a program during system boot or user login. The documented patterns are these.
- Placing a shortcut in the startup folder so a tool runs at login.
- Creating a new shortcut as indirection, and using Masquerading so it looks like a legitimate program.
- Editing the target path of an existing shortcut, or replacing it entirely, so the malware runs instead of the intended program.
- Modifying LNK browser extensions so malware launches persistently.
Shortcuts also show up earlier in attacks. MITRE notes they are often payloads in an infection chain, for example a Spearphishing Attachment, before they are repurposed for persistence.
How to detect it
The MITRE detection strategy correlates file creation or modification of .lnk files in autostart locations with anomalous parent and child process lineage, or with unsigned binaries.
Useful filters for your own tuning:
- LNK creation or edits outside known software installs, patch events and OS updates.
- Shortcut targets that point at suspicious locations or unknown binaries.
- LNK files written by script interpreters, or spawned from a phishing delivery chain.
File creation events (Sysmon Event ID 11) on the startup folders give you the raw data.
How to reduce the risk
MITRE lists three mitigations.
- Execution Prevention: allow only authorized applications and scripts to run, so an unwanted target does nothing.
- Restrict File and Directory Permissions: apply strict permissions to directories where shortcuts live, such as the startup folder.
- User Account Management: limit who can create and modify shortcuts in system critical locations, and review regularly which accounts have write access to the startup folders. MITRE notes the Create symbolic links user right can be set through Group Policy, though it is not directly the same as creating a
.lnkfile.
Check your own environment
Read-only PowerShell listings of both startup locations.
Get-ChildItem "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" -Force
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -Force
- Do you recognize every entry?
- Does any shortcut target a user writable path, or a script host?
- Who has write access to the all-users folder?
Quick check
Name two ways an adversary abuses an existing shortcut.
By editing its target path, or by replacing the shortcut entirely, so that their malware runs instead of the legitimate program.
Sources
- MITRE ATT&CK, Boot or Logon Autostart Execution: Shortcut Modification: https://attack.mitre.org/techniques/T1547/009
