Boot or Logon Autostart Execution: Shortcut Modification

APT39 has modified LNK shortcuts.^[2]

Astaroth's initial payload is a malicious .LNK file. ^[3][4]

BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.^[5]

Bazar can establish persistence by writing shortcuts to the Windows Startup folder.^[6][7]

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.^[8]

Comnie establishes persistence via a .lnk file in the victim’s startup path.^[9]

Empire can persist by modifying a .LNK file to include a backdoor.^[10]

FELIXROOT creates a .LNK file for persistence.^[11]

Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.^[12][13]

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.^[14]

Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.^[15]

Helminth establishes persistence by creating a shortcut.^[16]

InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.^[17]

Kazuar adds a .lnk file to the Windows startup folder.^[18]

A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.^[19]

Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.^[20]

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.^[21][22]

MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.^[23]

Micropsia creates a shortcut to maintain persistence.^[24]

Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.^[25]

Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.^[26]

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.^[27][28]

RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.^[29][30]

S-Type may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk, which points to the malicious msdtc.exe file already created in the %CommonFiles% directory.^[31]

SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.^[32]

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.^[5]

SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.^[5]

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an "Office Start," "Yahoo Talk," "MSN Gaming Z0ne," or "MSN Talk" shortcut.^[33]

TinyZBot can create a shortcut in the Windows startup folder for persistence.^[34]

Prevents malicious shortcuts or LNK files from executing unwanted code by ensuring only authorized applications and scripts are allowed to run.

Applying strict permissions to directories where shortcuts are stored, such as the startup folder, can prevent unauthorized modifications.

Limit Privileges for Shortcut Creation: While the SeCreateSymbolicLinkPrivilege is not directly related to .lnk file creation, you should still enforce least privilege principles by limiting user rights to create and modify shortcuts, especially in system-critical locations. This can be done through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create symbolic links. ^[35]

Regular User Permissions Review: Regularly review and audit user permissions to ensure that only necessary accounts have write access to startup folders and critical system directories.