Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for T1027.012.
Upgrade to ProDetect LNK Icon Smuggling in Google Chronicle
This detection identifies adversary abuse of Windows shortcut (.LNK) file metadata — specifically the IconEnvironmentDataBlock (icon location field) and target path field — to smuggle commands or URLs that download malicious payloads. Threat actors including Kimsuky, Gamaredon Group, and Mustang Panda have leveraged crafted LNK files delivered via phishing or USB to execute scripts and binaries while displaying benign icons (e.g., PDF, Word document). Detection focuses on LNK files spawning unusual child processes, network connections originating from LNK-invoked interpreters, suspicious icon paths pointing to remote UNC or HTTP locations, and command-line interpreters launched with padded or obfuscated arguments consistent with LNK target field abuse.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1027 Obfuscated Files or Information
- Sub-technique
- T1027.012 LNK Icon Smuggling
- Canonical reference
- https://attack.mitre.org/techniques/T1027/012/
YARA-L Detection Query
rule lnk_icon_smuggling_download {
meta:
author = "argus-v1"
description = "Detects LNK file abuse where shortcut metadata triggers download of remote payloads via scripting interpreters"
severity = "HIGH"
tactic = "TA0005"
technique = "T1027.012"
false_positives = "Corporate deployment shortcuts, legitimate update launchers"
version = "1.0"
events:
$launch.metadata.event_type = "PROCESS_LAUNCH"
$launch.principal.process.file.full_path = /(?i)explorer\.exe$/
$launch.target.process.file.full_path = /(?i)(powershell|cmd|wscript|cscript|mshta|certutil|bitsadmin|rundll32)\.exe$/
(
$launch.target.process.command_line = /(?i)(http[s]?:\/\/|ftp:\/\/)/
or $launch.target.process.command_line = /(?i)(downloadstring|downloadfile|webclient|invoke-expression|iex\s*\()/
or $launch.target.process.command_line = /(?i)\.lnk/
)
$launch.principal.hostname = $hostname
$net.metadata.event_type = "NETWORK_CONNECTION"
$net.principal.hostname = $hostname
$net.target.process.file.full_path = /(?i)(powershell|cmd|wscript|cscript|mshta)\.exe$/
not $net.target.ip = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
match:
$hostname over 3m
condition:
$launch and $net
}Chronicle YARA-L 2.0 rule correlating Explorer-spawned interpreter launches with HTTP/download arguments and subsequent outbound network connections from the same host within a 3-minute window, consistent with LNK icon smuggling payload delivery.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate web-based application launchers deployed via Active Directory shortcuts
- Chrome or other browser helper LNK files that invoke PowerShell for extension management
- IT ticketing or remote support tools that create shortcuts with external HTTPS references
Other platforms for T1027.012
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1LNK Icon Path URL Trigger via PowerShell Download
Expected signal: DeviceProcessEvents: powershell.exe spawned by explorer.exe with -WindowStyle Hidden and DownloadString URL; DeviceNetworkEvents: outbound connection from powershell.exe to 127.0.0.1:8080; Sysmon Event ID 11: LNK file creation in %TEMP%; Sysmon Event ID 3: network connection from powershell.exe
- Test 2LNK Target Field Padding to Bypass Visual Inspection
Expected signal: Sysmon Event ID 1 or Security Event ID 4688: cmd.exe spawned by explorer.exe; CommandLine field showing /c echo command with 300+ trailing spaces; Sysmon Event ID 11: lnk_test_output.txt created in %TEMP%
- Test 3LNK File Executing mshta for Remote HTA Payload
Expected signal: DeviceProcessEvents: mshta.exe spawned by explorer.exe with HTTP URL argument; DeviceNetworkEvents: outbound HTTP GET from mshta.exe to 127.0.0.1:8080; Sysmon Event ID 1: mshta.exe with command line containing http://; Sysmon Event ID 3: network connection from mshta.exe process
References (5)
- https://attack.mitre.org/techniques/T1027/012/
- https://unprotect.it/technique/shortcut-icon-smuggling/
- https://blog.talosintelligence.com/mustang-panda-targets-europe/
- https://www.mandiant.com/resources/blog/lnk-icon-smuggling-technique
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1027.012/T1027.012.md
Unlock playbooks & atomic tests with Pro
Get the full detection package for T1027.012 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month