T1027.012 — LNK Icon Smuggling

Tactic: Stealth · Platforms: Windows

Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`)…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (1)

T1027.012 Obfuscated Files or Information: LNK Icon Smuggling

title: "T1027.012 Obfuscated Files or Information: LNK Icon Smuggling"
id: daa56bf3-5034-4b22-8706-2f7967a66733
description: 'Detection Strategy for LNK Icon Smuggling via explorer.exe outbound network connections triggered when rendering a malicious IconEnvironmentDataBlock path. Cannot directly parse LNK IconEnvironmentDataBlock contents from Sysmon telemetry alone; this is a defensible observable proxy. Tune using: ParentProcessName, DestinationIP, TimeWindow, FileExtension.'
references:
  - https://attack.mitre.org/techniques/T1027/012
author: Shahrukh Khan
date: 2026-01-29
license: MIT
tags:
  - attack.stealth
  - attack.t1027.012

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Image|endswith: '\explorer.exe'
    Initiated: 'true'
    DestinationPort:
      - 80
      - 443
      - 445

  filter_private_ranges:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'

  condition: selection and not filter_private_ranges

falsepositives:
  - explorer.exe legitimately reaching external hosts for other reasons (cloud-synced folders, mapped drives to external partner shares).

level: medium

Related sub-techniques

Explore