Techniques › T1547.009 › AN0510
AN0510 Analytic 0510
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection correlates file creation or modification of
.lnk (shortcut) files in autostart locations with anomalous parent-child process lineage or unsigned binaries. Defenders should watch for LNK creation/modification events outside of known software installations, patch events, or OS updates. Flag shortcut targets pointing to suspicious locations or unknown binaries, particularly those written by script interpreters or spawned from phishing delivery chains.</p>- Detects
- T1547.009 Shortcut Modification
- Part of
- DET0180 Detection Strategy for T1547.009 – Shortcut Modification (Windows)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=2 | DC0061 File Modification |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=15 | DC0059 File Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TargetPathRegex | Tunable regex to flag suspicious shortcut target paths (e.g., temp folder, base64 in target, unusual executable names) |
TimeWindow | Time window used to correlate shortcut creation with process execution (e.g., 5-minute window) |
UserContextScope | Filter for expected administrative installs versus end-user initiated shortcut creation |
ZoneIdentifierThreshold | Configurable value to filter LNK files tagged with external source markers (e.g., ZoneId=3 for Internet) |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2024-21762 | Fortinet FortiOS | Mapped |