Sigma rule: Uncommon Link.EXE Parent Process

Rule

Title

Uncommon Link.EXE Parent Process

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-08-22

Modified

2024-06-27

File

rules/windows/process_creation/proc_creation_win_link_uncommon_parent_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects an uncommon parent process of "LINK.EXE".
Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.
Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity.
This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location.
By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.

Log source

product

windows

category

process_creation

Detection

selection:
    Image|endswith: '\link.exe'
    CommandLine|contains: 'LINK /' # Hardcoded command line when we call tools like dumpbin.exe, editbin.exe, lib.exe...etc
# Add other filters for other legitimate locations
filter_main_visual_studio:
    ParentImage|startswith:
        - 'C:\Program Files\Microsoft Visual Studio\'
        - 'C:\Program Files (x86)\Microsoft Visual Studio\'
    ParentImage|contains:
        - '\VC\bin\'
        - '\VC\Tools\'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1218

MITRE ATT&CK ids this rule names

• T1218

References

• https://twitter.com/0gtweet/status/1560732860935729152

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_link_uncommon_parent_process.yml