Direct action you can take to confound the adversary? Yes please.
Thanks to the always-amazing Will Dormann, we have some valuable information on the continued exploitation of .URL file extensions by threat actors. And it turns out, per Will, that Microsoft doesn’t view this as a problem—indeed, it is “expected behavior.”
So how do you fix it?
Registry haxx, of course.
For the current user:
reg add HKCU\Software\Classes\.url /ve /d DisabledURLFile /f
reg add HKCU\Software\Classes\DisabledURLFile /ve /d "Disabled Internet Shortcut" /f
reg add HKCU\Software\Classes\DisabledURLFile\shell\open\command /ve /d "notepad.exe \"%1\"" /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url /f
In an elevated shell for the system:
reg delete HKCU\Software\Classes\.url /f
reg delete HKCU\Software\Classes\DisabledURLFile /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url /f
reg delete HKLM\Software\Classes\.url.original /f
reg copy HKLM\Software\Classes\.url HKLM\Software\Classes\.url.original /s /f
reg delete HKLM\Software\Classes\.url /f
reg add HKLM\Software\Classes\.url /ve /d DisabledURLFile /f
reg add HKLM\Software\Classes\DisabledURLFile /ve /d "Disabled Internet Shortcut" /f
reg add HKLM\Software\Classes\DisabledURLFile\shell\open\command /ve /d "notepad.exe \"%1\"" /f
And while you’re at it, do the same thing for .js files to prevent JScript malware.
reg add HKCR\JSFile\shell\Open\Command /ve /d "notepad.exe \"%1\"" /f
reg add HKLM\SOFTWARE\Classes\JSFile\shell\Open\Command /ve /d "notepad.exe \"%1\"" /f
reg add HKCU\SOFTWARE\Classes\JSFile\shell\Open\Command /ve /d "notepad.exe \"%1\"" /f