What happens when a phishing email delivers an LNK file that launches a remote PowerShell script?

The shortcut can trigger PowerShell, which then fetches or decodes a second-stage script and loads the payload directly into memory. That chain lets attackers move from email delivery to execution with few visible files on disk. If defenders only watch for attachments and do not inspect script behavior, they can miss the transition from lure to active compromise.

How an LNK-Triggered PowerShell Chain Turns Email Into Execution

An LNK attachment is a shortcut, not the final payload. The important shift is that the shortcut can launch a command interpreter or script host, which then reaches out for a remote script or decodes an embedded one. That means the real execution point is often the follow-on script, not the attachment itself.

In practice, that distinction matters because email security tools may see only a benign-looking shortcut until the script activity starts. Once PowerShell runs, the attack can fetch content, decode commands, and move straight into in-memory execution, which reduces obvious file artefacts and makes the chain harder to spot with attachment-only triage.

Why This Attack Chain Is Effective

This pattern works because it splits delivery and execution across different stages and different telemetry sources. The email gateway sees an attachment, the endpoint sees a scripting engine, and the payload may never need to land as a conventional executable. That separation gives defenders a narrow window to catch the handoff between user interaction and script initiation.

It also exploits trust in common administrative tooling. PowerShell is legitimate, widely allowed, and frequently used by support and automation teams, so malicious use can blend into ordinary activity unless command lines, child processes, network callbacks, and script content are inspected together. MITRE ATT&CK Enterprise Matrix is useful for mapping that handoff to known execution, command-and-scripting, and follow-on access techniques.

The chain is especially effective when the script is remote or heavily obfuscated. The attachment only needs to start the sequence, after which the payload can arrive later, be reconstructed in memory, or be staged through multiple lightweight requests. That makes detonation and static attachment scanning less reliable than behavioural inspection.

What Defenders Need to Watch

The most important signals are not the lnk file alone, but the downstream behaviours it triggers. Suspicious indicators include shortcut launches that spawn PowerShell, encoded or obfuscated command lines, web requests to fetch second-stage content, and script hosts loading content without a matching file write. Endpoint telemetry that correlates parent-child process chains is far more useful than attachment reputation by itself.

Where a team is building a detection or hardening baseline, the relevant control question is whether scripting activity is allowed to initiate from user email context at all, and if so, how tightly it is monitored. NIST SP 800-53 Rev 5 Security and Privacy Controls is a strong reference point for process monitoring, privileged execution, and system integrity controls, while NIST Cybersecurity Framework 2.0 supports the broader detect and protect functions that should surround this chain.

The key operational lesson is that the payload may be active before a traditional file-based scan ever has a chance to classify it. If your environment blocks suspicious attachments but does not inspect script behaviour, you are only seeing the first half of the attack.

Risk and Threat Considerations

This technique is risky because it combines social engineering with a low-friction execution path, then uses memory resident staging to reduce artefacts. That makes it attractive for initial access, payload delivery, and early persistence attempts, especially where users are allowed to open shortcuts and scripting is only lightly monitored.

Failure mechanism: The shortcut launches a trusted scripting process, which retrieves or reconstructs the next stage and executes it outside the attachment boundary. Defenders that rely on attachment filtering alone often miss the process transition that marks compromise.

Impact: The result can be rapid execution with limited disk evidence, making triage, containment, and retrospective hunting harder. If the same script path is reused across multiple hosts, the blast radius can expand quickly through repeated user interaction or shared delivery infrastructure.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1059 — Command and Scripting Interpreter	PowerShell execution and remote script loading are command-and-scripting behaviours.
Recommendation — Map the LNK-to-PowerShell chain to T1059 and hunt for suspicious child-process and script activity.
NIST SP 800-53 Rev 5	AU-12 — Audit Record Generation	The attack depends on process and script visibility to spot execution after delivery.
	SI-4 — System Monitoring	Behavioural monitoring is needed to catch the handoff from attachment to active compromise.
Recommendation — Enable audit record generation for process creation and script execution events. Monitor endpoint and script activity for attachment-triggered execution chains.
NIST CSF 2.0	DE.CM-01 — Networks and physical devices are monitored to detect anomalies and events	Detecting the chain requires monitoring for unusual process and network behaviour.
Recommendation — Correlate process launches and outbound requests to detect malicious shortcut execution.
OWASP ASVS	V16 — Security Logging and Error Handling	The main defensive challenge is logging the execution path that follows the email lure.
Recommendation — Log script launches and remote fetches so attachment-triggered execution can be investigated.

Practitioner Guidance

What to verify: Check whether your endpoint telemetry records the full parent-child chain from email client to shortcut execution to PowerShell, and whether script block logging or equivalent visibility is enabled. If the chain is not visible end-to-end, the control gap is in detection, not just filtering.

What good looks like: A suspicious LNK launch should be explainable without guessing. You should be able to identify the originating message, the process tree, the network destination, and the exact script content or encoded command that followed. If any of those pieces are missing, treat the event as an incomplete investigation rather than a clean block.

Practitioner takeaway: The defensive problem is not the shortcut by itself, but the execution pivot it creates. Prioritise telemetry that shows how a benign-looking attachment becomes an active script chain, because that is where email delivery turns into compromise.