Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1027.012_lnk-icon-smuggling
Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files.
Passed 21 of 25 test cases with the skill, and 16 of 25 without it.
and 2 more in the full report
5 fixed16 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our vulnerability management database requires assigning a common weakness enumeration identifier to findings where Windows security controls fail to validate shortcut file icon paths, allowing external payload fetch. What CWE identifier applies?
| Checked | Without skill | With skill |
|---|---|---|
| Classifies the weakness under CWE-693. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1027
Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the IconEnvironmentDataBlock) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory.
Adversaries may abuse this LNK metadata to download malicious payloads. For example, adversaries have been observed using LNK files as phishing payloads to deliver malware. Once invoked (e.g., Malicious File), payloads referenced via external URLs within the LNK icon location field may be downloaded. These files may also then be invoked by Command and Scripting Interpreter/System Binary Proxy Execution arguments within the target path field of the LNK.
LNK Icon Smuggling may also be utilized post compromise, such as malicious scripts executing an LNK on an infected host to download additional malicious payloads.
Platforms: Windows
Identify Attack Surface: Determine if the target environment is susceptible to LNK Icon Smuggling by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1027.012 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 16 / 25 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.