tfMITRE ATT&CK sub-technique

Shortcut Modification T1547.009

sub-technique of T1547 Boot or Logon Autostart Execution

Tactics: Persistence, Privilege Escalation
Platform: Windows
Version: 1.3
Created: 24 January 2020
Last modified: 24 October 2025
Contributors: David French, Elastic; Bobby, Filar, Elastic; Travis Smith, Tripwire

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 14%

Tools & malware86th percentile · 86% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Shortcut Modification MITRE reference T1547.009

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT39G0087 ↗

Has modified LNK shortcuts.1

created 2019-02-191 referenceaka ITG07

Gorgon GroupG0078 ↗

Malware can create a .lnk file and add a Registry Run key to establish persistence.1

created 2018-10-171 reference

LeviathanG0065 ↗

Has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.1 2

created 2018-04-182 referencesaka MUDCARP

Lazarus GroupG0032 ↗

Malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.1

created 2017-05-311 referenceaka Labyrinth Chollima

All 4 groups for this technique

Offense vs defense T1547.009

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0

first rule: 2020 Q1

Shortcut Modification detection strategy DET0180

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for T1547.009 – Shortcut Modification (Windows)

Enterprise

1 platform

AN0510 · Windows

Detection correlates file creation or modification of .lnk (shortcut) files in autostart locations with anomalous parent-child process lineage or unsigned binaries. Defenders should watch for LNK creation/modification events outside of known software installations, patch events, or OS updates. Flag shortcut targets pointing to suspicious locations or unknown binaries, particularly those written by script interpreters or spawned from phishing delivery chains.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
File MetadataDC0059	WinEventLog:Sysmon	EventCode=15
File ModificationDC0061	WinEventLog:Sysmon	EventCode=2

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetPathRegex	Tunable regex to flag suspicious shortcut target paths (e.g., temp folder, base64 in target, unusual executable names)
TimeWindow	Time window used to correlate shortcut creation with process execution (e.g., 5-minute window)
UserContextScope	Filter for expected administrative installs versus end-user initiated shortcut creation
ZoneIdentifierThreshold	Configurable value to filter LNK files tagged with external source markers (e.g., ZoneId=3 for Internet)

Tests2Executorscmd 1 · PowerShell 1Need elevation1 of 2Have prerequisites0Have cleanup2Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Shortcut Modification

windows

cmd

—

Yes

This test to simulate shortcut modification and then execute. example shortcut (*.lnk , .url) strings check with powershell; gci -path "C:\Users" -recurse -include *.url -ea SilentlyContinue | Select-String -Pattern "exe" | FL. Upon execution, calc.exe will be launched.

Input arguments

Name	Type	Default	Description
shortcut_file_path	path	%temp%\T1547.009_modified_shortcut.url	shortcut modified and execute

Attack command

echo [InternetShortcut] > #{shortcut_file_path}
echo URL=C:\windows\system32\calc.exe >> #{shortcut_file_path}
#{shortcut_file_path}

Cleanup command

del -f #{shortcut_file_path} >nul 2>&1

GUID4cf34b1a-e769-4b1e-abb0-012f646598c3

Create shortcut to cmd in startup folders

windows

PowerShell

Required

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Shortcut Modification detections T1547.009

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs