Link (.lnk) to Ransom

[Rob.M.P]

Are .ink files blocked by default?

https://blogs.technet.microsoft.com/mmp ... to-ransom/

[pdwalker]

I believe so.

/etc/MailScanner/filename.rules.conf has the following line which suggests it is blocked by default.

Code: Select all

deny    \.lnk$    Possible Eudora *.lnk security hole attack    Eudora *.lnk security hole attack

But rather than guess, send yourself a text file with the extension .lnk and see what happens.

In fact, I am going to test it now myself, just to be sure - and yes, my test .lnk file was marked as "bad content" and not delivered.

Excellent.