value:  Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file. ;; Dragonfly 2.0 manipulated .lnk files to gather user credentials in conjunction with Forced Authentication. ;; Empire can persist by modifying a .LNK file to include a backdoor. ;; FELIXROOT creates a .LNK file for persistence. ;; Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe. ;; Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence. ;; Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions. ;; Helminth establishes persistence by creating a shortcut. ;; InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence. ;; Kazuar adds a .lnk file to the Windows startup folder. ;; A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence. ;; A Lazarus Group malware sample adds persistence on the system by creating a shortcut in the user’s Startup folder. ;; Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor. ;; Micropsia creates a shortcut to maintain persistence. ;; Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder. ;; Reaver creates a shortcut file and saves it in a Startup folder to establish persistence. ;; RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. ;; RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in. ;; S-Type may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk which points to the malicious msdtc.exe file already created in the %CommonFiles% directory. ;; SeaDuke is capable of persisting via a .lnk file stored in the Startup directory. ;; SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder. ;; SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder. ;; To establish persistence SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start ” “Yahoo Talk ” “MSN Gaming Z0ne ” or “MSN Talk” shortcut. ;; TinyZBot can create a shortcut in the Windows startup folder for persistence.
name: Boot or Logon Autostart Execution: Shortcut Modification