Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1027.012sub-technique of T1027 Obfuscated Files or Information

LNK Icon Smuggling

Windowsnothing on this site yetT1027.012 on attack.mitre.org

Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for LNK Icon Smuggling

  • Correlates LNK file execution with embedded resource extraction or suspicious network activity following initial launch, often leading to payload delivery via disguised icons.

what reduces it

  • M1040 Behavior Prevention on Endpoint. On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated scripts or payloads.
  • M1049 Antivirus/Antimalware. Use signatures or heuristics to detect malicious LNK and subsequently downloaded files.

the rest of T1027

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.