Embedded script execution via shortcut file

Detects execution of embedded scripts delivered via Windows shortcut (.lnk) files. Adversaries can exploit the attack chain where a shortcut file is accessed by a scripting or command interpreter, followed by the creation of a payload in user-writable locations and the subsequent execution of a script.

• Platform: Windows
• Severity: High
• MITRE Tactic: Execution
• MITRE Techniques: T1204, T1204.002

Back to all rules