MITRE ATT&CK - Техника Изменение ярлыков

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Boot or Logon Autostart Execution: Изменение ярлыков

Other sub-techniques of Boot or Logon Autostart Execution (15)

ID	Название
.001	Ключи запуска в реестре / Папка автозагрузки
.002	Пакет аутентификации
.003	Поставщики времени
.004	DLL-библиотеки загружаемые с помощью Winlogon
.005	Поставщик поддержки безопасности (SSP)
.006	Модули и расширения ядра
.007	Перезапуск приложений
.008	Драйвер LSASS
.009	Изменение ярлыков
.010	Мониторы портов
.011	Plist Modification
.012	Обработчики печати
.013	Записи автозапуска XDG
.014	Активная установка
.015	Элементы входа в систему

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.(Citation: Shortcut for Persistence ) Although often used as payloads in an infection chain (e.g. Spearphishing Attachment), adversaries may also create a new shortcut as a means of indirection, while also abusing Masquerading to make the malicious shortcut appear as a legitimate program. Adversaries can also edit the target path or entirely replace an existing shortcut so their malware will be executed instead of the intended legitimate program. Shortcuts can also be abused to establish persistence by implementing other methods. For example, LNK browser extensions may be modified (e.g. Browser Extensions) to persistently launch malware.

ID: T1547.009

Относится к технике: T1547

Тактика(-и): Persistence, Privilege Escalation

Платформы: Windows

Требуемые разрешения: Administrator, User

Источники данных: File: File Creation, File: File Modification, Process: Process Creation

Версия: 1.2

Дата создания: 24 Jan 2020

Последнее изменение: 19 Oct 2022

Название	Описание
Примеры процедур
RogueRobin	RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.(Citation: Unit 42 DarkHydrus July 2018)(Citation: Unit42 DarkHydrus Jan 2019)
RedLeaves	RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Accenture Hogfish April 2018)
Okrum	Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.(Citation: ESET Okrum July 2019)
Reaver	Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.(Citation: Palo Alto Reaver Nov 2017)
Grandoreiro	Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.(Citation: IBM Grandoreiro April 2020)
APT39	APT39 has modified LNK shortcuts.(Citation: FireEye APT39 Jan 2019)
Helminth	Helminth establishes persistence by creating a shortcut.(Citation: Palo Alto OilRig May 2016)
MarkiRAT	MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.(Citation: Kaspersky Ferocious Kitten Jun 2021)
Micropsia	Micropsia creates a shortcut to maintain persistence.(Citation: Talos Micropsia June 2017)
Dragonfly 2.0	Dragonfly 2.0 manipulated .lnk files to gather user credentials in conjunction with Forced Authentication.(Citation: US-CERT TA18-074A)
Leviathan	Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)
SslMM	To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.(Citation: Baumgartner Naikon 2015)
Lazarus Group	Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: ClearSky Lazarus Aug 2020)
Comnie	Comnie establishes persistence via a .lnk file in the victim’s startup path.(Citation: Palo Alto Comnie)
Gazer	Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.(Citation: ESET Gazer Aug 2017)(Citation: Securelist WhiteBear Aug 2017)
BlackEnergy	The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.(Citation: F-Secure BlackEnergy 2014)
SPACESHIP	SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.(Citation: FireEye APT30)
TinyZBot	TinyZBot can create a shortcut in the Windows startup folder for persistence.(Citation: Cylance Cleaver)
Astaroth	Astaroth's initial payload is a malicious .LNK file. (Citation: Cofense Astaroth Sept 2018)(Citation: Cybereason Astaroth Feb 2019)
APT29	APT29 drops a Windows shortcut file for execution.(Citation: FireEye APT29 Nov 2018)
Darkhotel	Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.(Citation: Securelist Darkhotel Aug 2015)
S-Type	S-Type may create the file `%HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk`, which points to the malicious `msdtc.exe` file already created in the `%CommonFiles%` directory.(Citation: Cylance Dust Storm)
SHIPSHAPE	SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.(Citation: FireEye APT30)
Gorgon Group	Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.(Citation: Unit 42 Gorgon Group Aug 2018)
BACKSPACE	BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.(Citation: FireEye APT30)
SeaDuke	SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.(Citation: Unit 42 SeaDuke 2015)
InvisiMole	InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.(Citation: ESET InvisiMole June 2020)
FELIXROOT	FELIXROOT creates a .LNK file for persistence.(Citation: ESET GreyEnergy Oct 2018)
KONNI	A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.(Citation: Talos Konni May 2017)
Bazar	Bazar can establish persistence by writing shortcuts to the Windows Startup folder.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)
Empire	Empire can persist by modifying a .LNK file to include a backdoor.(Citation: Github PowerShell Empire)
Kazuar	Kazuar adds a .lnk file to the Windows startup folder.(Citation: Unit 42 Kazuar May 2017)

Контрмера	Описание
Контрмеры
User Account Management	Manage the creation, modification, use, and permissions associated to user accounts.

Обнаружение

Since a shortcut's target path likely will not change, modifications to shortcut files that do not correlate with known software changes, patches, removal, etc., may be suspicious. Analysis should attempt to relate shortcut file change or creation events to other potentially suspicious events based on known adversary behavior such as process launches of unknown executables that make network connections. Monitor for LNK files created with a Zone Identifier value greater than 1, which may indicate that the LNK file originated from outside of the network.(Citation: BSidesSLC 2020 - LNK Elastic)

Ссылки

Связанные риски

Риск	Связи
Закрепление злоумышленника в ОС из-за возможности изменения ярлыка или символьной ссылки в ОС Windows Повышение привилегий НСД
Повышение привилегий в ОС из-за возможности изменения ярлыка или символьной ссылки в ОС Windows Повышение привилегий Целостность

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.