Windows Shortcut (LNK) User Execution

A Windows Shell Link (.lnk) file identifies a target and may store command-line arguments and an icon location. When a user opens a malicious shortcut, its configured target may execute; the shortcut format alone does not make a file malicious. Where an organization accepts externally delivered files through email, web, chat, or shared resources, a malicious file can be opened without a prior internal foothold, but delivery exposure and user action are prerequisites. The included controlled steps create and open only a benign local Notepad shortcut and do not test delivery.