LNK Stomping: Attackers Bypass Windows Security by Stripping the ‘Mark of the Web’

Windows shortcut files (.LNK) were designed to simplify user navigation, but for years, they’ve been a favorite tool in the attacker’s arsenal. With Microsoft tightening macro-blocking policies in 2022, adversaries increasingly shifted toward alternative formats like ISO, RAR, and especially LNK files to deliver malicious payloads.

According to AhnLab researchers, “LNK files are commonly distributed via email attachments or embedded within compressed archives. When executed, they often invoke trusted system utilities like PowerShell, cmd.exe, or mshta.exe, making the payload execution appear as legitimate system activity.”

A particularly insidious technique known as LNK Stomping was disclosed in 2024 by Elastic Security Labs and later detailed in AhnLab’s research. The vulnerability, tracked as CVE-2024-38217, abuses Windows Explorer’s path normalization process to bypass the Mark of the Web (MoTW), a crucial safeguard that labels files downloaded from the Internet.

As the report explains, “LNK Stomping is an attack that manipulates the actual execution program path of a Windows shortcut file (.lnk) with an abnormal target path or internal structure. It then prompts explorer.exe to remove the MoTW metadata during the ‘normalization (Canonicalization)’ process, thereby bypassing security checks.”

This means that a malicious LNK file, once clicked, can shed its warning label before SmartScreen or Smart App Control (SAC) policies even have the chance to intervene.

AhnLab identifies several abnormal structures attackers can use:

• PathSegment Type – embedding the entire path in a single IDList array, creating structural errors.
• Dot Type – appending a period (.) or space at the end of the target path to break normal validation.
• Relative Type – referencing only the file name rather than a proper path.

When tested under Windows 10 with SAC and SmartScreen enabled, the difference was striking. “First, when an LNK file without the LNK Stomping is executed, the file is blocked from being executed according to the SAC policy due to MoTW. However, when an LNK file with the LNK Stomping is used under the same conditions, the intended behavior is executed without being blocked.”

Although no single threat group has been officially linked to CVE-2024-38217, public samples suggest that attackers have been experimenting with this technique for years. Joe Desimone of Elastic Security Labs identified multiple samples exhibiting LNK Stomping patterns on VirusTotal. Notably, the oldest submission dates back six years (as of August 6, 2024).

The vulnerability’s addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on September 10, 2024, confirms that it is being used in the wild, with Rapid7 and other security firms warning about its active abuse.

AhnLab concludes: “Attacks abusing LNK files have become a persistent threat rather than a one-time trend. Techniques like LNK Stomping demonstrate how adversaries continue to refine evasion methods to bypass modern security controls.”

Related Posts:

• Muti vulnerabilities (Remote Code Execution) exist on Spring
• LNK Files and SSH Commands: The New Arsenal of Advanced Cyber Attacks
• Stealthy REMCOS Backdoor Delivered by LNK Files: Bypasses Antivirus with Multi-Stage PowerShell Attack
• Hidden Threat: Zero-Day Windows Shortcut Exploited by Global APT Networks