CyberStack

MITRE ATT&CK / Techniques / T1547.009

Boot or Logon Autostart Execution: Shortcut Modification

ID
T1547.009
Tactics
TA0003 Persistence, TA0004 Privilege Escalation
Sub-technique of
T1547 Boot or Logon Autostart Execution
Platforms
Windows
Data sources
File Creation, File Modification, Process Creation, File Metadata
Source
attack.mitre.org
MITRE last modified
25 Oct 2025

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.[2] Although often used as payloads in an infection chain (e.g. Spearphishing Attachment), adversaries may also create a new shortcut as a means of indirection, while also abusing Masquerading to make the malicious shortcut appear as a legitimate program. Adversaries can also edit the target path or entirely replace an existing shortcut so their malware will be executed instead of the intended legitimate program.

Shortcuts can also be abused to establish persistence by implementing other methods. For example, LNK browser extensions may be modified (e.g. Browser Extensions) to persistently launch malware.

Detection

Mitigations (3)

M1018 User Account Management

Limit Privileges for Shortcut Creation: While the SeCreateSymbolicLinkPrivilege is not directly related to .lnk file creation, you should still enforce least privilege principles by limiting user rights to create and modify shortcuts, especially in system-critical locations. This can be done through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create symbolic links. [1]

Regular User Permissions Review: Regularly review and audit user permissions to ensure that only necessary accounts have write access to startup folders and critical system directories.

M1022 Restrict File and Directory Permissions

Applying strict permissions to directories where shortcuts are stored, such as the startup folder, can prevent unauthorized modifications.

M1038 Execution Prevention

Prevents malicious shortcuts or LNK files from executing unwanted code by ensuring only authorized applications and scripts are allowed to run.

Groups (4)

Software (25)

References

  1. UCF STIG Symbolic Links
  2. Shortcut for Persistence