Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1547.009: Shortcut Modification

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.[1] Although often used as payloads in an infection chain (e.g. Spearphishing Attachment), adversaries may also create a new shortcut as a means of indirection, while also abusing Masquerading to make the malicious shortcut appear as a legitimate program. Adversaries can also edit the target path or entirely replace an existing shortcut so their malware will be executed instead of the intended legitimate program.

Shortcuts can also be abused to establish persistence by implementing other methods. For example, LNK browser extensions may be modified (e.g. Browser Extensions) to persistently launch malware.

EnterpriseT1547.009Sub-techniqueObject v1.3 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Shortcut Modification is a Windows persistence and privilege-escalation behavior where an adversary creates or changes shortcut/symbolic-link targets so unwanted code runs at startup, logon, or when a user launches what appears to be a normal program. For leaders, the material risk is quiet re-entry after cleanup: if startup locations and shortcut targets are not monitored and locked down, an incident can look remediated while the attacker’s code still runs on the next login.

Executive priority

Prioritize this as a Windows endpoint resilience and incident-response validation issue. Ask whether SOC and IR teams can prove they collect evidence of shortcut creation/modification in startup-related paths and can compare shortcut targets against expected business applications. Control investment should focus on least privilege, file/directory permission hardening, and execution prevention, as reflected by ATT&CK mitigations M1018, M1022, and M1038. This also supports audit evidence around endpoint hardening and account privilege management.

Technical view

ATT&CK lists this as sub-technique T1547.009 under Boot or Logon Autostart Execution for Windows, mapped to persistence and privilege escalation. Validate monitoring for shortcut files and symbolic links that are created, modified, replaced, or redirected to unexpected executables, scripts, or paths, especially where execution occurs during startup or user logon. Because MITRE provides no official detection text for this object, use the related DET0180 detection strategy as a starting point but test it against local Windows build, endpoint logging, EDR visibility, and normal software deployment behavior. Relationships to Masquerading and Spearphishing Attachment in the description mean defenders should correlate suspicious shortcut changes with deceptive file names, user-delivered files, and subsequent process execution rather than treating LNK writes as isolated events.

Likely telemetry

  • Windows file creation/modification events for shortcut files and symbolic links
  • Changes in user or system startup-related folders and shortcut target paths
  • Endpoint process execution telemetry showing programs launched at boot, logon, or via shortcut invocation
  • File metadata and path context for newly created or replaced shortcuts
  • EDR or host audit records showing the user or process responsible for shortcut modification

Detection direction

  • Inventory legitimate shortcut creation and update patterns from installers, software updates, login scripts, and user customization before alerting broadly.
  • Alert on shortcut creation or modification in startup-related locations where the target path points to unusual, user-writable, removable, or masqueraded content.
  • Correlate shortcut changes with subsequent execution at logon/startup and with suspicious parent processes or recently delivered attachments when available.
  • Review existing logic against the related DET0180 strategy, but do not assume coverage because ATT&CK supplies no official detection procedure for this technique.
  • Tune false positives from enterprise software deployment tools and sanctioned application updates while preserving visibility into target-path replacement of existing shortcuts.

Mitigation priorities

  • Apply least privilege and user account management so ordinary users and compromised accounts have fewer opportunities to modify shared or sensitive startup locations.
  • Restrict file and directory permissions on startup-related folders and other sensitive shortcut locations to limit unauthorized writes or replacement.
  • Use execution prevention controls so even if a malicious shortcut exists, unapproved payloads are less likely to run.
  • Include shortcut-target validation in endpoint hardening baselines and post-incident recovery checks.
  • Educate administrators and responders that benign-looking shortcuts can be persistence mechanisms, especially when combined with masquerading.
Analyst notes and limits

The ATT&CK relationship set shows this behavior has been documented across multiple groups and malware families, including Lazarus Group, Leviathan, Gorgon Group, APT39, and several Windows malware entries. Treat that as evidence of broad technique relevance, not as attribution in any local incident. The revoked T1023 object is replaced by this sub-technique, so detection content should reference T1547.009 going forward.

The supplied ATT&CK object has no official detection text and provides only Windows as a platform. This take does not assert active exploitation, customer exposure, or guaranteed detection. Local validation is required to identify actual startup paths in use, normal shortcut modification volume, endpoint logging depth, and whether DET0180 or any internal analytic covers the required telemetry.

Official MITRE ATT&CK definition

Shortcut Modification

Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.[1] Although often used as payloads in an infection chain (e.g. Spearphishing Attachment), adversaries may also create a new shortcut as a means of indirection, while also abusing Masquerading to make the malicious shortcut appear as a legitimate program. Adversaries can also edit the target path or entirely replace an existing shortcut so their malware will be executed instead of the intended legitimate program.

Shortcuts can also be abused to establish persistence by implementing other methods. For example, LNK browser extensions may be modified (e.g. Browser Extensions) to persistently launch malware.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
Domain ID Name Relationship / procedure
Enterprise T1547 Boot or Logon Autostart Execution This object subtechnique of Boot or Logon Autostart Execution.
Enterprise T1023 Shortcut Modification Shortcut Modification revoked by this object.
Associated objects

Groups, software, and campaigns

Group Enterprise

G0087: APT39

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.[1][2][3][4][5]

Group Enterprise

G0065: Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

Group Enterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Group Enterprise

G0078: Gorgon Group

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. [1]

Malware Enterprise

S0172: Reaver

Reaver is a malware family that has been in the wild since at least late 2016. Reporting indicates victims have primarily been associated with the "Five Poisons," which are movements the Chinese government considers dangerous. The type of malware is rare due to its final payload being in the form of Control Panel items.[1]

Windows
Malware Enterprise

S0531: Grandoreiro

Grandoreiro is a banking trojan written in Delphi that was first observed in 2016 and uses a Malware-as-a-Service (MaaS) business model. Grandoreiro has confirmed victims in Brazil, Mexico, Portugal, and Spain.[1][2]

Windows
Malware Enterprise

S0170: Helminth

Helminth is a backdoor that has at least two variants - one written in VBScript and PowerShell that is delivered via a macros in Excel spreadsheets, and one that is a standalone Windows executable. [1]

Windows
Malware Enterprise

S0089: BlackEnergy

BlackEnergy is a malware toolkit that has been used by both criminal and APT actors. It dates back to at least 2007 and was originally designed to create botnets for use in conducting Distributed Denial of Service (DDoS) attacks, but its use has evolved to support various plug-ins. It is well known for being used during the confrontation between Georgia and Russia in 2008, as well as in targeting Ukrainian institutions. Variants include BlackEnergy 2 and BlackEnergy 3. [1]

Windows
Relationship explorer

All related ATT&CK context

uses · Malware S0270: RogueRobin Enterprise subtechnique of · Technique T1547: Boot or Logon Autostart Execution Enterprise uses · Malware S0153: RedLeaves Enterprise uses · Malware S0439: Okrum Enterprise uses · Malware S0172: Reaver Enterprise uses · Malware S0531: Grandoreiro Enterprise uses · Group G0087: APT39 Enterprise detects · Detection Strategy DET0180: Detection Strategy for T1547.009 – Shortcut Modification (Windows) Enterprise uses · Malware S0170: Helminth Enterprise mitigates · Mitigation M1018: User Account Management Enterprise mitigates · Mitigation M1038: Execution Prevention Enterprise uses · Malware S0652: MarkiRAT Enterprise uses · Malware S0339: Micropsia Enterprise uses · Group G0065: Leviathan Enterprise mitigates · Mitigation M1022: Restrict File and Directory Permissions Enterprise uses · Malware S0058: SslMM Enterprise uses · Group G0032: Lazarus Group Enterprise uses · Malware S0244: Comnie Enterprise uses · Malware S0168: Gazer Enterprise uses · Malware S0089: BlackEnergy Enterprise uses · Malware S0035: SPACESHIP Enterprise uses · Malware S0004: TinyZBot Enterprise uses · Malware S0373: Astaroth Enterprise uses · Malware S0085: S-Type Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1018: User Account Management

User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures:

Enforcing the Principle of Least Privilege

- Implementation: Assign users only the minimum permissions required to perform their job functions. Regularly audit accounts to ensure no excess permissions are granted. - Use Case: Reduces the risk of privilege escalation by ensuring accounts cannot perform unauthorized actions.

Implementing Strong Password Policies

- Implementation: Enforce password complexity requirements (e.g., length, character types). Require password expiration every 90 days and disallow password reuse. - Use Case: Prevents adversaries from gaining unauthorized access through password guessing or brute force attacks.

Managing Dormant and Orphaned Accounts

- Implementation: Implement automated workflows to disable accounts after a set period of inactivity (e.g., 30 days). Remove orphaned accounts (e.g., accounts without an assigned owner) during regular account audits. - Use Case: Eliminates dormant accounts that could be exploited by attackers.

Account Lockout Policies

- Implementation: Configure account lockout thresholds (e.g., lock accounts after five failed login attempts). Set lockout durations to a minimum of 15 minutes. - Use Case: Mitigates automated attack techniques that rely on repeated login attempts.

Multi-Factor Authentication (MFA) for High-Risk Accounts

- Implementation: Require MFA for all administrative accounts and high-risk users. Use MFA mechanisms like hardware tokens, authenticator apps, or biometrics. - Use Case: Prevents unauthorized access, even if credentials are stolen.

Restricting Interactive Logins

- Implementation: Restrict interactive logins for privileged accounts to specific secure systems or management consoles. Use group policies to enforce logon restrictions. - Use Case: Protects sensitive accounts from misuse or exploitation.

*Tools for Implementation*

Built-in Tools:

- Microsoft Active Directory (AD): Centralized account management and RBAC enforcement. - Group Policy Object (GPO): Enforce password policies, logon restrictions, and account lockout policies.

Identity and Access Management (IAM) Tools:

- Okta: Centralized user provisioning, MFA, and SSO integration. - Microsoft Azure Active Directory: Provides advanced account lifecycle management, role-based access, and conditional access policies.

Privileged Account Management (PAM): - CyberArk, BeyondTrust, Thycotic: Manage and monitor privileged account usage, enforce session recording, and JIT access.

Mitigation Enterprise

M1038: Execution Prevention

Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures:

Application Control:

- Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applications and block unauthorized ones. On Linux, use tools like SELinux or AppArmor to define mandatory access control policies for application execution. - Implementation: Allow only digitally signed or pre-approved applications to execute on servers and endpoints. (e.g., `New-AppLockerPolicy -PolicyType Enforced -FilePath "C:\Policies\AppLocker.xml"`)

Script Blocking:

- Use Case: Use script control mechanisms to block unauthorized execution of scripts, such as PowerShell or JavaScript. Web Browsers: Use browser extensions or settings to block JavaScript execution from untrusted sources. - Implementation: Configure PowerShell to enforce Constrained Language Mode for non-administrator users. (e.g., `Set-ExecutionPolicy AllSigned`)

Executable Blocking:

- Use Case: Prevent execution of binaries from suspicious locations, such as `%TEMP%` or `%APPDATA%` directories. - Implementation: Block execution of `.exe`, `.bat`, or `.ps1` files from user-writable directories.

Dynamic Analysis Prevention: - Use Case: Use behavior-based execution prevention tools to identify and block malicious activity in real time. - Implemenation: Employ EDR solutions that analyze runtime behavior and block suspicious code execution.

Mitigation Enterprise

M1022: Restrict File and Directory Permissions

Restricting file and directory permissions involves setting access controls at the file system level to limit which users, groups, or processes can read, write, or execute files. By configuring permissions appropriately, organizations can reduce the attack surface for adversaries seeking to access sensitive data, plant malicious code, or tamper with system files.

Enforce Least Privilege Permissions:

- Remove unnecessary write permissions on sensitive files and directories. - Use file ownership and groups to control access for specific roles.

Example (Windows): Right-click the shared folder → Properties → Security tab → Adjust permissions for NTFS ACLs.

Harden File Shares:

- Disable anonymous access to shared folders. - Enforce NTFS permissions for shared folders on Windows.

Example: Set permissions to restrict write access to critical files, such as system executables (e.g., `/bin` or `/sbin` on Linux). Use tools like `chown` and `chmod` to assign file ownership and limit access.

On Linux, apply: `chmod 750 /etc/sensitive.conf` `chown root:admin /etc/sensitive.conf`

File Integrity Monitoring (FIM):

- Use tools like Tripwire, Wazuh, or OSSEC to monitor changes to critical file permissions.

Audit File System Access:

- Enable auditing to track permission changes or unauthorized access attempts. - Use auditd (Linux) or Event Viewer (Windows) to log activities.

Restrict Startup Directories:

- Configure permissions to prevent unauthorized writes to directories like `C:\ProgramData\Microsoft\Windows\Start Menu`.

Example: Restrict write access to critical directories like `/etc/`, `/usr/local/`, and Windows directories such as `C:\Windows\System32`.

- On Windows, use icacls to modify permissions: `icacls "C:\Windows\System32" /inheritance:r /grant:r SYSTEM:(OI)(CI)F` - On Linux, monitor permissions using tools like `lsattr` or `auditd`.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
d45a7a57556022fd...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.3 Current bundle d45a7a575560…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Shortcut for Persistence

    Elastic. (n.d.). Shortcut File Written or Modified for Persistence. Retrieved June 1, 2022.

    Open source URL
  2. [2]
    BSidesSLC 2020 - LNK Elastic

    French, D., Filar, B.. (2020, March 21). A Chain Is No Stronger Than Its Weakest LNK. Retrieved November 30, 2020.

    Open source URL
  3. [3]
    mitre-attack T1547.009
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use