Skip to content

Shortcut Modification

Subtechnique · ATTACK:enterprise:T1547.009

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1547.009",
  "title": "Shortcut Modification",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1547/009",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--4ab929c6-ee2d-4fb5-aab4-b14be2ed7179",
  "external_id": "T1547.009",
  "domain": "enterprise",
  "created": "2020-01-24T19:00:32.917Z",
  "modified": "2025-10-24T17:48:44.403Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "persistence",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "Shortcut for Persistence ",
      "url": "https://www.elastic.co/guide/en/security/7.17/shortcut-file-written-or-modified-for-persistence.html#shortcut-file-written-or-modified-for-persistence"
    },
    {
      "source_name": "BSidesSLC 2020 - LNK Elastic",
      "url": "https://www.youtube.com/watch?v=nJ0UsyiUEqQ"
    }
  ]
}

Explicit source assertions (33)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0270 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0040312a-e85d-4066-8203-2e66f8aa5288

Unit 42 DarkHydrus July 2018 · Unit42 DarkHydrus Jan 2019

ATTACK:enterprise:T1547.009 → subtechnique-of → ATTACK:enterprise:T1547

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--049ce77e-19b0-4641-8e49-8504ab47921e

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07921720-429b-432c-8147-187162326ff2

Accenture Hogfish April 2018 · PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09962c1d-38be-43f6-83bc-a63d1bebdb2d

ESET Okrum July 2019

ATTACK:enterprise:S0172 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fee8bfd-aec2-44a7-8182-530a648006f3

Palo Alto Reaver Nov 2017

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17a834a6-8d77-4fee-bd02-539d93f6fa5c

IBM Grandoreiro April 2020

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25557d9f-bfa0-4da7-8352-ab56b82b475b

FireEye APT39 Jan 2019

ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3537c31f-bd6f-4cad-97ac-4ec3d8a9478b

Palo Alto OilRig May 2016

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39080201-a56c-4daf-83b8-8ec09dd3baea

UCF STIG Symbolic Links

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c0938ab-9272-492b-96f6-df6caea210e5

ATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--410bd9e9-8ca7-4c3d-b517-e4d5b516333f

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:S0339 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--583d2c3b-dd25-4f83-812a-d38cee3cdeef

Talos Micropsia June 2017

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--728dce0a-125c-4d66-8622-36d4d909352b

Proofpoint Leviathan Oct 2017 · FireEye Periscope March 2018

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78aa862c-56a1-477b-b2d0-8d48d1969354

ATTACK:enterprise:S0058 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79ecf1f6-a17d-4374-a84c-811669e39261

Baumgartner Naikon 2015

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b4ee7bc-3a27-4142-a9bd-f65787193e8b

McAfee Lazarus Resurfaces Feb 2018

ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cb37ba3-3a4b-45e5-974c-e337301e71a2

Palo Alto Comnie

ATTACK:enterprise:S0168 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ec988a7-712a-45ae-b6b3-db26a6515b80

ESET Gazer Aug 2017 · Securelist WhiteBear Aug 2017

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8200c438-ec29-4f0e-81c3-9a058c735748

F-Secure BlackEnergy 2014

ATTACK:enterprise:S0035 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a48e090-ab8c-414e-b559-7a0437c92850

ATTACK:enterprise:S0004 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ce2219f-6c25-46a2-8215-a78871e2773a

Cylance Cleaver

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d34f263-bd94-44a4-b8ec-b6cae06dcdd2

Cofense Astaroth Sept 2018 · Cybereason Astaroth Feb 2019

ATTACK:enterprise:S0085 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--907df22e-fdfe-4b93-8b18-ebf66f83868c

Cylance Dust Storm

ATTACK:enterprise:S0028 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97ff5931-f27f-4774-b595-312f5771f91a

ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1ec1602-33d6-45be-8eda-2020094e93a4

Unit 42 Gorgon Group Aug 2018

ATTACK:enterprise:S0031 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c327c333-46c4-4e23-81e0-2f0e07c24c11

ATTACK:enterprise:S0053 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfc64939-1c2c-4bc0-bfac-3492667b1bcd

Unit 42 SeaDuke 2015

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db61e886-9295-4df7-a9db-25d7b9879b82

ESET InvisiMole June 2020

ATTACK:enterprise:S0267 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e394c235-8567-4198-9559-fb3952672fe0

ESET GreyEnergy Oct 2018

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e57361ca-1d03-4171-86e2-09f8c32cb319

Talos Konni May 2017

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed61e0a2-f6a7-43b1-b58e-aa0ab9c51c4e

Cybereason Bazar July 2020 · NCC Group Team9 June 2020

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f26c53f1-b346-4301-9951-22ffd96ee762

Github PowerShell Empire

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1547.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc572a1d-a44d-4588-b31d-1c54116d12f4

Unit 42 Kazuar May 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.