Uncommon Link.EXE Parent Process

SIGMA detection rule by Nasreddine Bencherchali (Nextron Systems) · GPL-2.0

Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation. Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity. This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location. By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.

title: Uncommon Link.EXE Parent Process
id: f2200f88-34e8-ad86-b006-fc01b177fad9
related:
    - id: 6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6
      type: derived
status: test
description: |
    Detects an uncommon parent process of "LINK.EXE".
    Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.
    Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity.
    This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location.
    By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.
references:
    - https://twitter.com/0gtweet/status/1560732860935729152
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-22
modified: 2024-06-27
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    process_creation:
        EventID: 4688
        Channel: Security
    selection:
        CommandLine|contains: LINK /   # Hardcoded command line when we call tools like dumpbin.exe, editbin.exe, lib.exe...etc
    # Add other filters for other legitimate locations
        NewProcessName|endswith: \link.exe
    filter_main_visual_studio:
        ParentProcessName|startswith:
            - C:\Program Files\Microsoft Visual Studio\
            - C:\Program Files (x86)\Microsoft Visual Studio\
        ParentProcessName|contains:
            - \VC\bin\
            - \VC\Tools\
    condition: process_creation and (selection and not 1 of filter_main_*)
falsepositives:
    - Unknown
level: medium
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

846405ea-ac66-4668-9f20-d76c7ef562c0

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion