Boot or Logon Autostart Execution: Shortcut Modification

APT29 drops a Windows shortcut file for execution.^[1]

APT39 has modified LNK shortcuts.^[2]

Astaroth's initial payload is a malicious .LNK file. ^[3][4]

BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.^[5]

Bazar can establish persistence by writing shortcuts to the Windows Startup folder.^[6][7]

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.^[8]

Comnie establishes persistence via a .lnk file in the victim’s startup path.^[9]

Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.^[10]

Dragonfly has manipulated .lnk files to gather user credentials in conjunction with Forced Authentication.^[11]

Empire can persist by modifying a .LNK file to include a backdoor.^[12]

FELIXROOT creates a .LNK file for persistence.^[13]

Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.^[14][15]

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.^[16]

Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.^[17]

Helminth establishes persistence by creating a shortcut.^[18]

InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.^[19]

Kazuar adds a .lnk file to the Windows startup folder.^[20]

A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.^[21]

Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.^[22][23]

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.^[24][25]

MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.^[26]

Micropsia creates a shortcut to maintain persistence.^[27]

Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.^[28]

Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.^[29]

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.^[30][31]

RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.^[32][33]

S-Type may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {{Unique Identifier}}.lnk, which points to the malicious msdtc.exe file already created in the %CommonFiles% directory.^[34]

SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.^[35]

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.^[5]

SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.^[5]

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an "Office Start," "Yahoo Talk," "MSN Gaming Z0ne," or "MSN Talk" shortcut.^[36]

Stuxnet used copies of .lnk shortcuts to propagate through removable media.^[37]

TinyZBot can create a shortcut in the Windows startup folder for persistence.^[38]

Limit permissions for who can create symbolic links in Windows to appropriate groups such as Administrators and necessary groups for virtualization. This can be done through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create symbolic links. ^[39]