Shortcut Modification
Shortcut Modification [T1547.009]
Last updated
Shortcut Modification [T1547.009]
Last updated
Name: Shortcut Modification
ID: T1547.009
Tactics: ,
Technique:
Shortcut Modification () is a sub-technique of the MITRE ATT&CK framework under the "Boot or Logon Autostart Execution" tactic. Attackers leverage shortcut files (LNK files) to achieve persistence by modifying shortcuts that users frequently interact with. By altering these shortcuts, adversaries can redirect legitimate user actions to execute malicious payloads, scripts, or commands, thus maintaining long-term access and control over compromised systems.
Shortcut Modification involves the manipulation of Windows shortcut files (.lnk files), which are typically used to quickly access applications, folders, or documents. Attackers exploit these shortcuts by modifying their properties to point toward malicious executables, scripts, or command-line instructions. The modified shortcuts can be placed in various strategic locations, including:
Desktop shortcuts
Start Menu shortcuts
Taskbar pinned shortcuts
Quick Launch shortcuts
Technical execution methods include:
Changing the "Target" property of the shortcut to reference malicious payloads.
Adding command-line arguments or scripts to existing legitimate executables.
Embedding malicious scripts or PowerShell commands within shortcut properties.
Utilizing hidden or system attribute flags to obscure malicious shortcuts from standard file explorers.
Attackers may also disguise malicious shortcuts by:
Using legitimate application icons and names to deceive users.
Placing shortcuts in legitimate directories (e.g., Program Files, System32) to evade suspicion.
Leveraging environment variables to dynamically reference malicious payloads or scripts, complicating detection and analysis.
Shortcut Modification is typically employed during the persistence phase of an attack lifecycle, allowing attackers to maintain continuous and stealthy access. It may also be utilized during the execution phase to trigger malicious payloads when users unknowingly interact with compromised shortcuts.
Common scenarios include:
Spear-phishing attacks delivering malicious shortcuts via email attachments or embedded links.
Post-compromise persistence, where attackers modify shortcuts on compromised systems to ensure continuous access.
Insider threats, where an attacker with internal access modifies shortcuts on shared resources or network drives.
Supply chain attacks, embedding malicious shortcuts within software installers or update packages.
Attack stages where this technique commonly appears:
Initial Access (via phishing or malicious downloads)
Execution (triggering malicious payloads upon shortcut interaction)
Persistence (maintaining long-term access through frequently used shortcuts)
Detection of Shortcut Modification involves monitoring and analyzing shortcut files for unexpected or suspicious changes. Key detection methods include:
File integrity monitoring (FIM) tools to detect unauthorized changes to shortcut files.
Endpoint detection and response (EDR) solutions that monitor shortcut creation, modification, and deletion events.
Behavioral analytics to identify unusual shortcut execution patterns or anomalous command-line arguments.
Regular auditing of shortcut targets and properties, especially in sensitive system locations (Desktop, Start Menu, Taskbar).
Monitoring Windows Event Logs for suspicious shortcut-related activities, such as creation or modification events captured by Sysmon (Event ID 11 - File Create events).
Analysis of shortcut metadata (timestamps, file paths, command arguments) to detect unauthorized changes or malicious payload references.
Indicators of Compromise (IoCs) include:
Shortcuts pointing to uncommon or suspicious executable paths or scripts.
Shortcuts containing encoded commands, PowerShell scripts, or suspicious command-line arguments.
Unexpected shortcut files appearing in sensitive directories (Startup folders, Desktop, Taskbar).
Shortcut files with hidden or system attributes set to evade detection.
Detecting Shortcut Modification is critical due to its potential impact on security, operational continuity, and data integrity. Early detection provides several key advantages:
Prevents persistent attacker footholds, limiting the duration and severity of breaches.
Reduces data exfiltration risks by identifying and mitigating malicious shortcuts before sensitive information is compromised.
Minimizes operational disruptions caused by malicious payload execution.
Enhances overall security posture by revealing broader intrusion attempts or lateral movement activities.
Protects user trust and organizational reputation by proactively detecting and mitigating potential compromises.
Potential impacts if Shortcut Modification remains undetected include:
Unauthorized remote access and persistent backdoors enabling ongoing attacks.
Execution of ransomware payloads or destructive malware causing significant operational disruption.
Data theft, espionage, or credential harvesting through stealthy execution of malicious scripts or executables.
Compromise of critical systems and escalation of privileges through malicious shortcut execution.
Real-world examples and attack scenarios involving Shortcut Modification include:
Operation Cloud Hopper (APT10):
Attackers modified shortcuts on compromised systems to execute malicious DLL payloads.
Leveraged legitimate shortcut icons and names to evade suspicion.
Impact: Persistent espionage activity, data exfiltration, and long-term access to sensitive networks.
FIN7 Campaigns:
Distributed malicious shortcut files via spear-phishing emails disguised as legitimate documents or invoices.
Shortcuts executed PowerShell scripts that downloaded and installed backdoor malware.
Impact: Financial fraud, theft of payment card data, and extensive compromise of retail and hospitality sectors.
Gamarue Malware Family:
Utilized modified shortcuts placed in removable media or network shares to propagate infection.
Shortcuts executed malicious scripts or executables upon user interaction.
Impact: Widespread infection, data theft, and system compromise across multiple networks.
Andromeda Botnet:
Created malicious shortcuts in the Startup folder to ensure persistent execution after system reboot.
Shortcuts executed malicious payloads and established command-and-control (C2) communications.
Impact: Persistent infections, botnet growth, DDoS attacks, and data theft activities.
Tools commonly used by attackers in Shortcut Modification include:
Native Windows utilities (e.g., PowerShell, cmd.exe, scripting languages)
Custom-crafted or publicly available malware frameworks (e.g., Cobalt Strike, Empire)
Shortcut editing and manipulation tools (e.g., LNK editors, scripting frameworks)
Understanding and analyzing these real-world examples highlights the importance of implementing proactive detection and mitigation strategies against Shortcut Modification attacks.