tfMITRE ATT&CK sub-technique

LNK Icon Smuggling T1027.012

sub-technique of T1027 Obfuscated Files or Information

Tactic: Stealth
Platform: Windows
Version: 2.0
Created: 29 September 2023
Last modified: 12 May 2026
Contributors: Michael Raggi @aRtAGGI; Andrew Northern, @ex_raritas; Gregory Lesnewich, @greglesnewich

Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the IconEnvironmentDataBlock) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

LNK Icon Smuggling MITRE reference T1027.012

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Mustang PandaG0129 ↗

Has utilized LNK files to hide malicious scripts for execution.1 2 Mustang Panda has also leveraged LNK files that were programmed to display a PDF icon to entice the victim to click on the file to execute an office.exe binary.3

created 2021-04-123 referencesaka TA416

KimsukyG0094 ↗

Has used the LNK icon location to execute malicious scripts.1 Kimsuky has also padded the LNK target field properties with extra spaces to obscure the script.2

created 2019-08-262 referencesaka Black Banshee

Gamaredon GroupG0047 ↗

Has used LNK files to hide malicious scripts for execution.1 2

created 2017-05-312 referencesaka IRON TILDEN

All 3 groups for this technique

Offense vs defense T1027.012

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

LNK Icon Smuggling detection strategy DET0405

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for LNK Icon Smuggling

Enterprise

1 platform

AN1134 · Windows

Correlates LNK file execution with embedded resource extraction or suspicious network activity following initial launch, often leading to payload delivery via disguised icons.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File MetadataDC0059	WinEventLog:Sysmon	EventCode=15
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessName	Can be tuned to focus on common launcher processes like explorer.exe or winword.exe.
DestinationIP	Filtered to exclude known good domains and internal IPs to reduce false positives.
TimeWindow	Time between LNK execution and subsequent suspicious activity may vary based on adversary delay.
FileExtension	Could be used to focus on .lnk files only or track associated dropped payloads like .dat, .exe, etc.

LNK Icon Smuggling detections T1027.012

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs