DET0405 Detection Strategy for LNK Icon Smuggling
| Item |
Value |
| ID |
DET0405 |
| Version |
1.0 |
| Created |
21 October 2025 |
| Last Modified |
21 October 2025 |
Technique Detected: T1027.012 (LNK Icon Smuggling)
Analytics
Windows
AN1134
Correlates LNK file execution with embedded resource extraction or suspicious network activity following initial launch, often leading to payload delivery via disguised icons.
Log Sources
Mutable Elements
| Field |
Description |
| ParentProcessName |
Can be tuned to focus on common launcher processes like explorer.exe or winword.exe. |
| DestinationIP |
Filtered to exclude known good domains and internal IPs to reduce false positives. |
| TimeWindow |
Time between LNK execution and subsequent suspicious activity may vary based on adversary delay. |
| FileExtension |
Could be used to focus on .lnk files only or track associated dropped payloads like .dat, .exe, etc. |