ATT&CK Technique
Shortcut Modification
T1023 · persistence
▤ Generate a SIEM detection for T1023
◈ Deployable detections for T1023
⚠ CVEs mapped to T1023
♛ Hunt package for T1023
Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries could use shortcuts to execute their tools for persistence. They may create a new shortcut as a means of indirection that may use Masquerading to look like a legitimate program.
Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.
Windows
▸
How to use this page - the detection-engineering loop
Attackers have goals (tactics - “get credentials”, “move laterally”) and techniques are the concrete methods they use to reach them. This page is one method - T1023 - broken into everything you need to catch it.
The loop this page is built for (this is the job):
- Understand the behaviour - read the description and the Atomic Tests to see exactly what the attacker does on a host or network.
- Find the telemetry - what data source would reveal it (process creation, registry, network flow, auth logs). Detection Coverage shows which surfaces already have a rule and which are blind.
- Get or write the detection - adapt ready logic (CAR Analytics, SIEM Detections, Falco, or Sigma via Generate a SIEM detection), or author your own.
- Test it - run an Atomic Test in a lab and confirm your rule actually fires. A detection you have not tested is a hope, not coverage.
- Deploy and tune - push it, then watch for false positives and adjust.
What each panel is for:
Atomic Testssafely reproduce the technique in a lab to validate that a detection fires.
Detection Coveragewhich detection surfaces have a rule for this technique; none is a blind spot to close, or simply not applicable (YARA matches files, not network behaviour).
CAR / SIEM / Falcoready-made detection logic (Splunk SPL, Elastic EQL, Sentinel KQL, Falco) you adapt to your own SIEM.
Mitigationsreduce exposure so the technique is harder to use at all - prevent, not just detect.
Actors / Attributionwho actually uses this, so you prioritise by your own threat model.
Attack Path / LOTLwhat attackers do before and after this step, and the legitimate tools they abuse to do it.
Where this fits: you usually arrive here from a CVE (“which techniques does it enable”) and leave with a tested detection deployed. The buttons above jump straight to building one, the deployable rules, the CVEs that use T1023, and a hunt package.
◈
Detection Coverage
0/9 layersCoverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).
Behavioral / log (Sigma)
none
Analytics (MITRE CAR)
none
Runtime / container (Falco)
none
File / malware (YARA)
none
Network (Suricata/Snort)
none
Vuln scan (Nuclei)
none
SIEM (Splunk ESCU)
none
SIEM (Elastic)
none
SIEM (Azure Sentinel)
none
External lookups - second-class, for what we don’t hold ourselves