Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 837630" data-attributes="member: 32260">Blocking shortcuts. Shortcuts are commonly used in Windows only in some locations (Start Menu, Desktop, etc.), but not from flash (USB) drives, Temp folder, or Download folder for sure.The shortcut malwares are used for years and become more sophisticated. The shortcut can point to the folder, file, or system location.[URL unfurl=&quot;true&quot;]https://blog.trendmicro.com/trendlabs-security-intelligence/rising-trend-attackers-using-lnk-files-download-malware/[/URL][URL unfurl=&quot;true&quot;]https://attack.mitre.org/techniques/T1023/[/URL]Malc0ders also found out how to hide the malware code in the shortcut itself, so there is no need to download the payload. The shortcut can execute command lines with LOLBins (usually PowerShell) to retrieve &amp; run the payload (usually DLL) which is hidden somewhere in this shortcut. This can be done also filelessly.[URL unfurl=&quot;true&quot;]https://cyberforensicator.com/2018/12/23/dissecting-cozy-bears-malicious-lnk-file/[/URL][URL unfurl=&quot;true&quot;]https://blog.huntresslabs.com/deep-dive-a-lnk-in-the-chain-6c0d1072160d[/URL]</blockquote>

[QUOTE="Andy Ful, post: 837630, member: 32260"] [B]Blocking shortcuts. [/B]Shortcuts are commonly used in Windows only in some locations (Start Menu, Desktop, etc.), but not from flash (USB) drives, Temp folder, or Download folder for sure. The shortcut malwares are used for years and become more sophisticated. The shortcut can point to the folder, file, or system location. [URL unfurl="true"]https://blog.trendmicro.com/trendlabs-security-intelligence/rising-trend-attackers-using-lnk-files-download-malware/[/URL] [URL unfurl="true"]https://attack.mitre.org/techniques/T1023/[/URL] Malc0ders also found out how to hide the malware code in the shortcut itself, so there is no need to download the payload. The shortcut can execute command lines with LOLBins (usually PowerShell) to retrieve & run the payload (usually DLL) which is hidden somewhere in this shortcut. This can be done also filelessly. [URL unfurl="true"]https://cyberforensicator.com/2018/12/23/dissecting-cozy-bears-malicious-lnk-file/[/URL] [URL unfurl="true"]https://blog.huntresslabs.com/deep-dive-a-lnk-in-the-chain-6c0d1072160d[/URL] [/QUOTE]

Verification