Detecting Malicious LNK Shortcut Files

A LNK file is a pointer with arguments, so a weaponised shortcut can run powershell, cmd, mshta or a script host with a full attack chain in the argument field, and present a document icon while doing it. Detection splits across where shortcuts arrive, how they execute and what the file structure gives away.

Signals at a Glance

Execution From Explorer

Double-clicking a shortcut makes explorer.exe the parent of the target. A user running a shortcut that launches an interpreter with a hidden window is a high-signal pattern, because normal shortcuts target applications and documents:

title: Explorer Launches Interpreter With Suspicious Arguments
logsource:
  product: windows
  category: process_creation
detection:
  parent:
    ParentImage|endswith: '\explorer.exe'
  child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  args:
    CommandLine|contains:
      - '-w hidden'
      - '-windowstyle hidden'
      - '-enc '
      - '-nop'
      - 'downloadstring'
      - 'iwr '
      - 'curl '
      - '/c start /min'
  condition: parent and child and args
level: high
# tune/validate: IT shortcuts and login helpers; scope out by signed script path or command hash.

Where Shortcuts Come From

A shortcut inside an archive or disk image is the common delivery shape. Hunt shortcut creation by the extraction or mount process, and measure the file instead of only reading the name:

// Defender XDR (KQL) - LNK created by an archive or image handler, then run within 30 minutes
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName endswith ".lnk"
| where InitiatingProcessFileName in~ ("7zFM.exe","winrar.exe","explorer.exe","msedge.exe","chrome.exe","outlook.exe")
| where FolderPath has_any ("Downloads","Temp","Content.Outlook")
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName =~ "explorer.exe"
    | where FileName in~ ("powershell.exe","cmd.exe","mshta.exe","wscript.exe","cscript.exe","rundll32.exe")
    | project RunTime=Timestamp, DeviceId, FileName, ProcessCommandLine
) on DeviceId
| where RunTime between (Timestamp .. Timestamp + 30m)
| project Timestamp, RunTime, DeviceName, LnkName=FileName, FolderPath, FileName1, ProcessCommandLine
// tune/validate: join on DeviceId is coarse; add the shortcut name to the command line check where logging allows

• Parse suspicious shortcuts with a LNK parser and read the target, arguments, working directory and embedded machine identifiers. Machine ID and volume serial values are useful pivots across campaigns.
• Measure size: a shortcut is normally under a few kilobytes, so tens or hundreds of kilobytes imply padding or embedded content.
• Block LNK at the gateway for most users, and strip it from archives and images where practical.