Procedure examples

RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.

To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.

InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.

Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.

MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.

Kazuar adds a .lnk file to the Windows startup folder.

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.

Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.

S-Type may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk, which points to the malicious `msdtc.exe` file already created in the `%CommonFiles%` directory.

SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.

Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.

A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.

SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.

Micropsia creates a shortcut to maintain persistence.

RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.

Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.

Bazar can establish persistence by writing shortcuts to the Windows Startup folder.

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.

TinyZBot can create a shortcut in the Windows startup folder for persistence.

FELIXROOT creates a .LNK file for persistence.

Astaroth's initial payload is a malicious .LNK file.

Helminth establishes persistence by creating a shortcut.

Comnie establishes persistence via a .lnk file in the victim’s startup path.

BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.

Empire can persist by modifying a .LNK file to include a backdoor.