Attackers Bypass Windows “Mark of the Web” Protections Using LNK-Stomping

A sophisticated attack technique called LNK Stomping is enabling cybercriminals to bypass Windows security protections designed to block malicious files downloaded from the internet. The technique exploits a vulnerability in Windows shortcuts that was patched as CVE-2024-38217, and it works by removing Mark of the Web metadata during Explorer’s path normalisation, allowing malicious LNK files to run with less scrutiny.

Attackers typically distribute these shortcuts via email attachments or compressed files, disguising them as legitimate documents, and when opened, they trigger trusted system tools such as PowerShell, cmd.exe, or mshta.exe.

Windows MoTW protections attach metadata to internet-downloaded files to support reputation checks, but LNK Stomping manipulates the LNK structure to cause metadata to be lost before checks occur, according to CISA which added CVE-2024-38217 to its Known Exploited Vulnerabilities list on 10 September 2024. In testing, malicious LNK files using LNK Stomping bypassed Smart App Control warnings, while those without the technique were blocked.

Joe Desimone from Elastic Security Labs found numerous LNK Stomping samples on VirusTotal, suggesting long-term underground use, and the article notes that, as yet, no specific threat groups have been officially attributed to exploiting this vulnerability.

Organisations are urged to install the September 2024 security patches and to implement behavioural detection rules to identify suspicious LNK activity, as traditional signature-based protections may struggle against this evasion technique, according to the article.