Uncommon Link.EXE Parent Process

 1title: Uncommon Link.EXE Parent Process
 2id: 6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6
 3status: test
 4description: |
 5    Detects an uncommon parent process of "LINK.EXE".
 6    Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.
 7    Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity.
 8    This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location.
 9    By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.    
10references:
11    - https://twitter.com/0gtweet/status/1560732860935729152
12author: Nasreddine Bencherchali (Nextron Systems)
13date: 2022-08-22
14modified: 2024-06-27
15tags:
16    - attack.defense-evasion
17    - attack.t1218
18logsource:
19    category: process_creation
20    product: windows
21detection:
22    selection:
23        Image|endswith: '\link.exe'
24        CommandLine|contains: 'LINK /' # Hardcoded command line when we call tools like dumpbin.exe, editbin.exe, lib.exe...etc
25    # Add other filters for other legitimate locations
26    filter_main_visual_studio:
27        ParentImage|startswith:
28            - 'C:\Program Files\Microsoft Visual Studio\'
29            - 'C:\Program Files (x86)\Microsoft Visual Studio\'
30        ParentImage|contains:
31            - '\VC\bin\'
32            - '\VC\Tools\'
33    condition: selection and not 1 of filter_main_*
34falsepositives:
35    - Unknown
36level: medium