MITRE ATT&CK technique · Persistence, Privilege Escalation

`T1547.009` Shortcut Modification

Sub-technique of T1547 Boot or Logon Autostart Execution

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.(Citation:…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Lazarus Group

Sigma rules to hunt it

Creation Exe for Service with Unquoted Pathhightest · windows
Desktop.INI Created by Uncommon Processmediumtest · windows
New Custom Shim Database Createdmediumtest · windows
Windows Network Access Suspicious desktop.ini Actionmediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.