Forced authentication using shortcut files

An operator stages a valid Windows shortcut (.lnk) whose icon or referenced resource points to an operator-controlled remote SMB resource. When Windows accesses or renders the remote resource, it may send an NTLM challenge-response for the current user's logon session. The lure can trigger during shell icon enumeration and does not necessarily need to be executed. The response is authentication material, not a plaintext password or proof that authentication to a service succeeded; access to the shortcut's staging path, user or shell access, outbound protocol reachability, and NTLM policy determine whether the request occurs.