1. Home
  2. ATT&CK Techniques
  3. T1547.009 Shortcut Modification

T1547.009 Shortcut Modification

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.(Citation: Shortcut for Persistence ) Although often used as payloads in an infection chain (e.g. Spearphishing Attachment), adversaries may also create a new shortcut as a means of indirection, while also abusing Masquerading to make the malicious shortcut appear as a legitimate program. Adversaries can also edit the target path or entirely replace an existing shortcut so their malware will be executed instead of the intended legitimate program.

Shortcuts can also be abused to establish persistence by implementing other methods. For example, LNK browser extensions may be modified (e.g. Browser Extensions) to persistently launch malware.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.AA-05.01 Access privilege limitation Mitigates T1547.009 Shortcut Modification
Comments
This diagnostic statement describes the implementation of least privilege principle, which can be applied to limiting permissions through role-based access controls, file and directory permissions, and the execution of systems and services. An adversary must already have high-level, admin or root level access on a local system to make full use of these ATT&CK techniques. Restrict users and accounts to the least privileges they require can help mitigate these techniques.
References
    PR.AA-01.02 Physical and logical access Mitigates T1547.009 Shortcut Modification
    Comments
    This diagnostic statement describes how the organization ensures users are identified and authenticated before accessing systems, applications, and hardware, with logical access controls permitting access only to authorized individuals with legitimate business needs. Logical access controls in relation to systems can refer to the use of MFA, user account management, and other role-based access control mechanisms to enforce policies for authentication and authorization of user accounts.
    References
      PR.AA-01.01 Identity and credential management Mitigates T1547.009 Shortcut Modification
      Comments
      This diagnostic statement protects against Shortcut Modification through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
      References

        NIST 800-53 Mappings

        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
        CM-06 Configuration Settings mitigates T1547.009 Shortcut Modification
        CM-05 Access Restrictions for Change mitigates T1547.009 Shortcut Modification
        AC-17 Remote Access mitigates T1547.009 Shortcut Modification
        SI-03 Malicious Code Protection mitigates T1547.009 Shortcut Modification
        IA-02 Identification and Authentication (Organizational Users) mitigates T1547.009 Shortcut Modification
        CM-07 Least Functionality mitigates T1547.009 Shortcut Modification
        SI-04 System Monitoring mitigates T1547.009 Shortcut Modification
        AC-02 Account Management mitigates T1547.009 Shortcut Modification
        AC-03 Access Enforcement mitigates T1547.009 Shortcut Modification
        AC-05 Separation of Duties mitigates T1547.009 Shortcut Modification
        AC-06 Least Privilege mitigates T1547.009 Shortcut Modification

        VERIS Mappings

        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
        attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1547.009 Shortcut Modification

        Azure Mappings

        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
        file_integrity_monitoring Microsoft Defender for Cloud: File Integrity Monitoring technique_scores T1547.009 Shortcut Modification
        Comments
        This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis.
        References
        1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview