Techniques › T1547 › T1547.009
T1547.009 Shortcut Modification
persistence · privilege escalation — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
4
Sigma rules tagged attack.t1547.009
1
KEV CVEs mapped here
<p>Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.</p><p>Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence. Although often used as payloads in an infection chain (e.g. Spearphishing Attachment), adversaries may also create a new shortcut as a means of indirection, while also abusing Masquerading to make the malicious shortcut appear as a legitimate program. Adversaries can also edit the target path or entirely replace an existing shortcut so their malware will be executed instead of the intended legitimate program.</p><p>Shortcuts can also be abused to establish persistence by implementing other methods. For example, LNK browser extensions may be modified (e.g. Browser Extensions) to persistently launch malware.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-21762 | Fortinet FortiOS | secondary impact | Mapped | 2024-02-09 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0180 Detection Strategy for T1547.009 – Shortcut Modification (Windows) v1.0
AN0510 WindowsDetection correlates file creation or modification of
.lnk(shortcut) files in autostart locations with anomalous parent-child process lineage or unsigned binaries. Defenders should watch for LNK creation/modification events outside of known software installations, patch events, or OS updates. Flag shortcut targets pointing to suspicious locations or unknown binaries, particularly those written by script interpreters or spawned from phishing delivery chains.Tunable:TargetPathRegexTimeWindowUserContextScopeZoneIdentifierThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1547.009
Author: Tim Shelton (HAWK.IO)
· 2021-12-06 (modified 2022-01-16) · logsource: product=windows service=security · 35bc7e28-ee6b-492f-ab04-da58fcf6402e
Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)
· 2020-03-19 (modified 2025-12-09) · logsource: product=windows category=file_event · 81315b50-6b60-4d8f-9928-3466e1022515
Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
Author: frack113
· 2021-12-30 · logsource: product=windows category=file_event · 8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2021-12-29 (modified 2023-12-06) · logsource: product=windows category=file_event · ee63c85c-6d51-4d12-ad09-04e25877a947
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.
Rules tagged at the parent level (attack.t1547) 7
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Elastic, Josh Nickels, Marius Rothenbücher
· 2024-09-06 · logsource: product=windows service=security · 123e4e6d-b123-48f8-b261-7214938acaf0
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Author: frack113
· 2021-11-18 (modified 2022-12-06) · logsource: product=windows category=registry_event · 277efb8f-60be-4f10-b4d3-037802f37167
Detects persistence registry keys for Recycle Bin
Author: Mateusz Wydra, oscd.community
· 2020-10-13 (modified 2023-01-19) · logsource: product=windows category=registry_event · 9577edbb-851f-4243-8c91-1d5b50c1a39b
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Author: Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger
· 2021-09-30 (modified 2022-10-09) · logsource: product=windows category=process_creation · a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1
Detects when a possible suspicious driver is being installed via pnputil.exe lolbin
Author: Greg (rule)
· 2022-07-21 (modified 2023-01-05) · logsource: product=windows category=file_event · a6976974-ea6f-4e97-818e-ea08625c52cb
Detects a phishing attack which expands a ZIP file containing a malicious shortcut.
If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder.
Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
Author: omkar72
· 2020-10-30 (modified 2021-11-27) · logsource: product=windows category=registry_event · b98968aa-dbc0-4a9c-ac35-108363cbf8d5
Detects potential malicious modification of run keys by winekey or team9 backdoor
Author: Florian Roth (Nextron Systems)
· 2022-05-19 · logsource: product=windows category=process_creation · f14e169e-9978-4c69-acb3-1cff8200bc36
Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors