> Source: [sk181337](https://support.checkpoint.com/results/sk/sk181337)

# sk181337 - New Threat Emulation engine for malicious LNK detection

| Property | Value |
|----------|-------|
| Solution ID | sk181337 |
| Date Created | 2023-07-31 |
| Last Modified | 2024-10-28 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS), R81 (EOS) |

## Solution

**A new Threat Emulation engine for malicious LNK detection**

Introduction
------------

Windows shortcut files (LNK files) give users quick access to resources on Windows systems. These files make it easier to access shared folders and customize shortcuts. However, attackers can use LNK files as weapons in cyber attacks.  

Attackers use malicious LNK files in these ways:

* To perform fileless attacks
* To create social engineering attacks
* To exploit USB drives
* To hijack legitimate shortcuts and run malicious code

Many users think LNK files are safe because they use them regularly to access files and applications. This trust makes users vulnerable because they do not examine LNK files carefully. Users must stay alert to keep their systems secure.
Attackers use these five methods to make dangerous LNK files look legitimate:  

1. **Icon Spoofing** : Attackers copy icons from common applications to make malicious shortcuts look safe.  

2. **File Attribute Manipulation** : Attackers change file attributes (for example, the creation and modification dates) of LNK files to match normal system files.  

3. **Name Obscurity** : Attackers give LNK files names that look like standard system files or common applications.  

4. **Hiding Extensions** : Attackers take advantage of the Windows default setting that hides file extensions. This lets them hide the "`.lnk`" extension.   

5. **Shortened URLs**: Attackers use URL shortening services to hide suspicious web addresses in the LNK file.

Here are two examples that show how attackers use LNK files:  

**Example 1: Code Execution from Configuration File**   
**File name** : `MEETING_REC.lnk`  
**Command** : `powershell.exe -windowstyle hidden iex $(get-content creditcard.cfg |out-string)`  

The file name "`MEETING_REC.lnk`" suggests it may contain recorded conversations or logs, but it might be misleading. The command "`powershell.exe -windowstyle hidden iex $(get-content creditcard.cfg | out-string)`" runs PowerShell in hidden mode and executes code from the "`creditcard.cfg`" file.  

**Example 2: Hidden Script Execution**   
**File name** : `businesstrip.rtf.lnk`  
**Command** : `wscript.exe "trash.dll" /ff //e:vbScript //b /bnk /mkv`  

The file name "`businesstrip.rtf.lnk`" suggests it may be a legitimate `RTF` file, but in reality, it conceals a malicious payload. The command runs the Windows Script Host (`wscript.exe`) to execute a script named "`trash.dll`" with various parameters, including `/ff` to force execution. The true intent of the script and its potential impact remain unclear, making it a potential security risk.   

In conclusion, an LNK file that executes an unknown script while masquerading as a document or an Excel file, raises significant security concerns. Its deceptive name indicates a harmless document, and its ability to run an undisclosed script suggests it may be a malicious file or a crucial part of a cyber-attack's execution chain.  

Malicious LNK detection
-----------------------

<br />

Introducing a cutting-edge Machine Learning (ML) model designed to detect malicious LNK files based on identifying malicious code execution and analyzing command-line arguments. This innovative model thoroughly investigates LNK files to determine if they execute potentially harmful code. By scrutinizing the command-line arguments used within these files, it can accurately discern any signs of malicious intent. With its advanced capabilities, this ML model provides a robust defense against malware and cyber threats, empowering users to safeguard their systems with greater confidence and stay one step ahead of potential attacks.  

The groundbreaking ML model possesses remarkable abilities that fortify its prowess in detecting malicious LNK files. Firstly, the model excels in identifying obfuscation techniques utilized to conceal harmful code in the files, ensuring that even the most sophisticated attempts at evasion are exposed. Secondly, its advanced Natural Language Processing (NLP) analysis enables it to decipher malicious topics embedded in LNK files, unveiling subtle linguistic patterns indicative of malicious intent. Lastly, the model effectively identifies similarities to well-known malicious code execution, promptly recognizing familiar tactics employed by cyber adversaries.   

By combining these three powerful capabilities, the ML model stands as an invaluable guardian against LNK-based cyber threats, fortifying cybersecurity defenses and fostering a safer digital landscape.  

The model underwent rigorous evaluation, demonstrating exceptional performance in detecting malicious LNK files. With an impressive detection rate of over 90%, it showcases its reliability and efficacy in identifying potential cyber threats accurately. Equally important, the model maintains a low false alarm rate, thus minimizing the occurrence of false positives and avoiding unnecessary alerts. This exceptional balance between high detection rates and low false alarms, reinforces the model's value as a robust defense against malicious LNK files, and instills confidence in its ability to protect systems from cyber-attacks with remarkable precision.  

**The new engine is now activated by default for all Threat Emulation Cloud customers!**

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content