Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Techniques

Techniques›Persistence›Shortcut Modification

Persistence

Shortcut Modification

T1547.009 · MITRE ATT&CK

This Windows procedure changes the TargetPath of an existing shortcut in the current user's Startup folder to an authorized test executable. If the shortcut remains in that folder, Windows can run its target at that user's next sign-in. The procedure does not edit Arguments or create a shortcut.

ArtifactsRESTRICTED_ACCESS_BLUR_MARKER

Steps1

CategoryUser Execution

Discuss in Advisor

Walkthrough

Step 1

RESTRICTED_ACCESS_BLUR_MARKER

RESTRICTED_ACCESS_BLUR_MARKER

Requirements: none specified (operational prerequisites may still apply)

Check before starting: RESTRICTED_ACCESS_BLUR_MARKER

Coverage Gap: No catalog tool command currently produces this step's declared outcomes.

Detection signal

Detection 01

RESTRICTED_ACCESS_BLUR_MARKER

Mitigations

Mitigation 01

RESTRICTED_ACCESS_BLUR_MARKER

OPSEC notes

RESTRICTED_ACCESS_BLUR_MARKER

References

Extended details

RESTRICTED_ACCESS_BLUR_MARKER