A Chain Is No Stronger Than Its Weakest LNK
summary
Describes how Windows .lnk files are abused for initial access, persistence and credential harvesting, and which file fields actually reveal misuse: target binary and long command-line args, high entropy and large file size (embedded payloads), zone identifier ADS, and hidden-window flags. Demonstrates parsing with Le command, abusing icon paths to force SMB auth, and weaponizers like linkup/invoke-backdoor-link. Builds a random forest classifier on ~30k malicious and ~2.5k benign samples, achieves only two misclassifications out of ~7k test cases but needs more benign data to reduce edge errors.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:13Agenda
- 2:28Why do attackers abuse LNK files?
- 4:53Historical summary of LNK file abuse How prevalent is LNK file abuse?
- 6:01LNK files in a nutshell
- 11:41How are LNK files abused by attackers? Common attacker tactics techniques, and procedures TTPSI
- 13:22LNK file abuse for Initial Access
- 17:34LNK file abuse for Persistence
- 22:17Data normalization and feature extraction
- 23:14Data normalization and feature engineering
- 24:19Choosing a method for classification
- 26:15Supervised learning model Putting it all together
related talks
44mAnatomy and Defense of LOTL Fileless Intrusions
14mPig in a Poke: Automatically Detecting and Exploiting Link Following...
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
32mFuture Open Source LLM Kill Chains
40mAll You Need Is One - A ClickOnce Love Story
57mHiding In Plain Sight - Advances In Malware Covert Communication Channels
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
28mAdversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker