LNK Post-Execution Self-Repair Detection

Ethan Andrews@eandrews

•updated Feb 20, 2026•6•0•120

Detects when explorer.exe modifies a .lnk file immediately after a suspicious process (e.g., LOLBAS) is launched by explorer.exe on the same host. This behavior is a forensic artifact of advanced LNK spoofing techniques (Variants 3 and 4 from the referenced research) where Windows "self-repairs" an internally inconsistent shortcut file after its first execution.