{"id":"T1027.012","name":"LNK Icon Smuggling","url":"https://attack.mitre.org/techniques/T1027/012","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0405","stix_id":"x-mitre-detection-strategy--ae3cb4bc-da0a-4e5b-b4ad-96617eccefaf","name":"Detection Strategy for LNK Icon Smuggling","url":"https://attack.mitre.org/detectionstrategies/DET0405","analytics":[{"id":"AN1134","stix_id":"x-mitre-analytic--11dd0dbf-e880-43d2-99f7-4b6bf9d821fa","name":"Analytic 1134","description":"Correlates LNK file execution with embedded resource extraction or suspicious network activity following initial launch, often leading to payload delivery via disguised icons.","url":"https://attack.mitre.org/detectionstrategies/DET0405#AN1134","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=15","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ParentProcessName","description":"Can be tuned to focus on common launcher processes like explorer.exe or winword.exe."},{"field":"DestinationIP","description":"Filtered to exclude known good domains and internal IPs to reduce false positives."},{"field":"TimeWindow","description":"Time between LNK execution and subsequent suspicious activity may vary based on adversary delay."},{"field":"FileExtension","description":"Could be used to focus on .lnk files only or track associated dropped payloads like .dat, .exe, etc."}],"live":true,"detection_strategies":["DET0405"],"techniques":["T1027.012"]}],"live":true,"version":"1.0","techniques":["T1027.012"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}