← Back to writeups Initial Access

LNK Files Are Dead

Why shortcuts no longer work for initial access - and what does

// What is this?

Why the classic malicious shortcut trick is largely patched — and what attackers use instead.

Windows .LNK shortcut files were once reliable initial access vectors — hovering over or right-clicking a crafted shortcut would execute code. Microsoft progressively killed these vectors through Mark of the Web enforcement, Protected View, and policy restrictions. This writeup covers the history of what worked, why each was patched, and the techniques that replaced them for phishing-based initial access.

PowerShell — LNK Detection

→ Blue Team

# Recently created LNK files
Get-ChildItem "$env:USERPROFILE" -Filter *.lnk -Recurse -Force -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-7) } |
  Select-Object FullName, CreationTime

# Parse LNK target
$shell = New-Object -ComObject WScript.Shell
Get-ChildItem "$env:USERPROFILE\Downloads" -Filter *.lnk | ForEach-Object {
  $lnk = $shell.CreateShortcut($_.FullName)
  [PSCustomObject]@{Name=$_.Name; Target=$lnk.TargetPath; Args=$lnk.Arguments}
}

If this flags: LNK files targeting PowerShell, cmd, mshta, or URLs are malicious. Check Arguments field for encoded payloads.

The Classic Technique

For years, malicious LNK (shortcut) files were a reliable initial access vector. Double-click a shortcut, it runs powershell.exe with encoded arguments, downloads a stager, and you're compromised.

This worked because LNK files could:

Disguise as documents (custom icons)
Execute arbitrary commands on double-click
Bypass "don't run executables" policies (it's "just a shortcut")

Why It's Dead

Modern endpoint protection has caught up:

LNK target scanning - EDR hooks ShellExecute and inspects what the shortcut actually runs
Argument inspection - Any LNK targeting PowerShell, cmd, wscript, or mshta with encoded/obfuscated arguments is flagged
URL detection - Embedded URLs in command lines trigger immediate alerts
Mark of the Web - Downloaded LNK files inherit MOTW and trigger SmartScreen

The detection is so reliable that LNK-based initial access is essentially a signature at this point.

What Replaced It

Technique	Why It Works	Limitation
ISO/IMG containers	Auto-mount bypasses MOTW on contents. Double extension (invoice.pdf.exe) shows PDF icon.	Windows 11 now propagates MOTW into mounted images
HTA files	`mshta.exe` is signed Microsoft binary. Can execute VBScript/JScript.	Increasingly monitored, MOTW applies
Office macros	VBA can download via MSXML2.XMLHTTP. Trusted document context.	Microsoft disabled macros in downloaded docs by default
MSI installers	Custom actions execute code. "Software installation" is expected behavior.	Requires user to click through install dialogs
OneNote attachments	Embedded files bypass many controls. 2023's favorite.	Microsoft patched in mid-2023

The Broader Lesson

Initial access techniques have a lifecycle:

Discovery - Novel technique, no detection
Adoption - Attackers use it, vendors notice
Detection - Signatures and heuristics deployed
Obsolescence - Only works against unpatched/unprotected targets

LNK files are firmly in stage 4. The cat-and-mouse continues with each new technique.

What to Monitor Instead

ISO mount events: Event ID 12 from Microsoft-Windows-VHDMP. Track mounted images from user Downloads/Desktop.

HTA execution: mshta.exe running from user directories. Any HTA from Downloads is suspicious.

Office macro execution: WINWORD.EXE spawning cmd.exe, powershell.exe, or making network connections.

MSI custom actions: msiexec.exe spawning unexpected child processes.

For Red Teams

If you're still using LNK files in engagements, you're testing whether the client has 2018-era detection. Modern assessments should use current techniques to provide meaningful security validation.

MITRE ATT&CK: T1204.002 (User Execution: Malicious File)