Thanks to all of our ATT&CKcon participants. All sessions are here, and individual presentations will be posted soon.

Shortcut Modification

Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use Masquerading to look like a legitimate program. Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.

ID: T1023

Tactic: Persistence

Platform:  Windows

Permissions Required:  User, Administrator

Data Sources:  File monitoring, Process monitoring, Process command-line parameters

Contributors:  Travis Smith, Tripwire

Version: 1.0

Examples

NameDescription
BACKSPACE

BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.[1]

BlackEnergy

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.[2]

Comnie

Comnie establishes persistence via a .lnk file in the victim’s startup path.[3]

Dragonfly 2.0

Dragonfly 2.0 manipulated .lnk files to gather user credentials in conjunction with Forced Authentication.[4]

FIN7

FIN7 created several .LNK files on the victim's machine.[5]

Gazer

Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.[6][7]

Gorgon Group

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.[8]

Helminth

Helminth establishes persistence by creating a shortcut.[9]

Kazuar

Kazuar adds a .lnk file to the Windows startup folder.[10]

Lazarus Group

A Lazarus Group malware sample adds persistence on the system by creating a shortcut in the user’s Startup folder.[11]

Leviathan

Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.[12][13]

Reaver

Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.[14]

RedLeaves

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.[15][16]

RogueRobin

RogueRobin establishes persistence by creating a shortcut in the Windows startup folder to run a script each time the user logs in.[17]

S-Type

S-Type may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk, which points to the malicious msdtc.exe file already created in the %CommonFiles% directory.[18]

SeaDuke

SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.[19]

SHIPSHAPE

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.[1]

SPACESHIP

SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.[1]

SslMM

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an "Office Start," "Yahoo Talk," "MSN Gaming Z0ne," or "MSN Talk" shortcut.[20]

TinyZBot

TinyZBot can create a shortcut in the Windows startup folder for persistence.[21]

Mitigation

Limit permissions for who can create symbolic links in Windows to appropriate groups such as Administrators and necessary groups for virtualization. This can be done through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create symbolic links. [22]

Identify and block unknown, potentially malicious software that may be executed through shortcut modification by using whitelisting [23] tools, like AppLocker, [24] [25] or Software Restriction Policies [26] where appropriate. [27]

Detection

Since a shortcut's target path likely will not change, modifications to shortcut files that do not correlate with known software changes, patches, removal, etc., may be suspicious. Analysis should attempt to relate shortcut file change or creation events to other potentially suspicious events based on known adversary behavior such as process launches of unknown executables that make network connections.

References

  1. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015.
  2. F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.
  3. Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.
  4. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  5. Carr, N., et al. (2018, August 01). On the Hunt for FIN7: Pursuing an Enigmatic and Evasive Global Criminal Operation. Retrieved August 23, 2018.
  6. ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.
  7. Kaspersky Lab's Global Research & Analysis Team. (2017, August 30). Introducing WhiteBear. Retrieved September 21, 2017.
  8. Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.
  9. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  10. Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.
  11. Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.
  12. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  13. FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.
  14. Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.