Hackers bypass Windows MoTW files with LNK Stomping

A sophisticated attack technique called LNK Stomping has emerged as a critical threat to Windows security, exploiting a fundamental flaw in the way the operating system handles shortcut files to bypass security checks.

See also: Microsoft released Patch Tuesday April 2025

This vulnerability, designated as CVE-2024-38217 and patched on September 10, 2024, shows how attackers can manipulate Windows shortcuts (LNK files) to bypass the Mark of the Web (MoTW), potentially allowing malicious code to execute without triggering security warnings.

The attack technique exploits the Windows Explorer, causing the system to inadvertently strip MoTW metadata from malicious files. This bypass allows attackers to execute payloads while avoiding detection by Smart App Control (SAC) and SmartScreen, two critical Windows security components designed to protect users from untrusted downloads.

ASEC reports that LNK Stomping exploits the complex binary structure of Windows shortcut files, specifically targeting the LinkTarget IDList component. This section contains Shell Item IDs that specify the hierarchical location of target files within the Windows Shell namespace. Attackers manipulate this structure by creating non-standard path configurations that cause explorer.exe to perform normalization operations.

The attack follows a specific sequence when a user clicks on a maliciously crafted LNK file that contains non-standard path structures. Windows Explorer detects the non-standard configuration and attempts to normalize it. During this process, the system overwrites the original LNK file while inadvertently removing the NTFS Alternate Data Stream (ADS) called Zone.Identifier, which contains the MoTW metadata. This removal occurs before security checks are performed, allowing the malicious payload to execute without triggering defense mechanisms.

See also: WinRAR “Mark of the Web” vulnerability allows arbitrary code

Three main manipulation techniques have been identified: PathSegment attacks place entire file paths within a single IDList array element instead of properly segmented elements. Dot attacks add dots or spaces to target execution paths. Relative attacks use only file names without full path specifications, all creating structural inconsistencies that trigger the normalization vulnerability.

Security researchers at Elastic Security Labs have identified numerous LNK Stomping samples on VirusTotal, with the oldest submissions dating back six years, indicating that this technique has been exploited long before its official disclosure. The technique’s effectiveness is due to its ability to appear as legitimate system behavior. When LNK files are executed, they invoke trusted tools , allowing malicious activities to blend seamlessly with normal system operations.

CISA added CVE-2024-38217 to the list of Known Exploitable Vulnerabilities (KEV), confirming active exploitation by malicious actors. This approach has become increasingly popular following Microsoft's macro blocking policies implemented in 2022, forcing attackers to seek alternative initial access channels through file formats such as ISO, RAR, and LNK distributed via email attachments or compressed archives.

See also: 7-Zip MotW bypass used in zero-day attacks against Ukraine

Organizations face significant detection challenges because the attack exploits fundamental Windows file management mechanisms rather than external vulnerabilities. Traditional signature-based detection methods may fail to detect these attacks, as they exploit legitimate system processes and file structures. The persistence of this vulnerability for years before its discovery highlights the importance of format-level security research and behavioral analysis to identify previously unknown evasion techniques in known file types.