{
  "family": "tsklnk",
  "sample_count": 4,
  "category": "trojan",
  "description": "Trojan:Win32/Tsklnk (Task Link) is a specific classification for malware that abuses legitimate Windows Shortcut files (`.lnk`) and the Windows Task Scheduler to establish highly evasive persistence and execute malicious payloads. It is often a component of a larger infection chain, heavily utilized by fileless malware and USB-spreading worms to execute PowerShell or VBScript without leaving a traditional executable on the disk.<br><br><b>Understanding Tsklnk (Malicious LNKs)</b><br>To an end-user, Tsklnk often appears as a benign icon (like a folder or a PDF document) on a USB drive or the desktop. When double-clicked, the icon might briefly flash a command prompt before opening the expected document, masking the malicious activity. For a security analyst, Tsklnk represents an abuse of fundamental Windows OS features (Living off the Land). Because `.lnk` files and Scheduled Tasks are native, administrative tools, they often bypass traditional antivirus scans.<br><br><b>Execution and Persistence Mechanics</b><br>Tsklnk is frequently delivered via phishing (as an attached `.lnk` disguised as a document) (`T1566.002`) or via infected USB drives (`T1091`). The core of the threat lies in the 'Target' property of the Shortcut file. Instead of pointing to an application, the `.lnk` file executes `cmd.exe` or `powershell.exe` (`T1059.003`), passing it an obfuscated, base64-encoded command line (`T1027`). This command often reaches out to a C2 server to download and execute a secondary payload entirely in memory (`T1105`). To achieve persistence, the malware creates a hidden Scheduled Task (`T1053.005`) that points to a similarly malicious `.lnk` file or directly executes a PowerShell one-liner every time the user logs in.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a stealthy, persistent backdoor. Host-based IoCs include EDR alerts for `cmd.exe` or `powershell.exe` being spawned by `explorer.exe` (when the user clicks the shortcut) with exceptionally long, encoded command-line arguments. The presence of anomalous Scheduled Tasks executing scripts or binaries from temporary directories, and `.lnk` files on USB drives with targets pointing to `cmd.exe` rather than an application, are definitive IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1059.003",
    "T1053.005",
    "T1566.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1566.002",
      "name": "Phishing: Spearphishing Link (Malicious .lnk attachments)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Clicking the shortcut)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Audit the Windows Task Scheduler across the affected endpoints, looking for tasks with suspicious triggers (e.g., 'At Logon') and actions executing `powershell.exe` or `cmd.exe` with encoded arguments.",
    "Use EDR to hunt for process execution events where the command line contains strings like `-ExecutionPolicy Bypass`, `-WindowStyle Hidden`, or base64 encoding (`-enc`, `-EncodedCommand`).",
    "Disable Windows AutoRun/AutoPlay to prevent LNK files on USB drives from executing automatically.",
    "Delete the malicious `.lnk` files and the scheduled tasks they created."
  ],
  "what_to_avoid": [
    "Do not assume the system is clean just because an antivirus scan removed a dropped executable; Tsklnk often operates 'filelessly' via the registry and scheduled tasks.",
    "Avoid interacting with suspicious shortcut files manually on a live system; analyze the LNK file properties using specialized forensic tools (like LEC) in an isolated environment."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}