Uncommon Link.EXE Parent Process
Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation. Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity. This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location. By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.
Sigma rule (View on GitHub)
1title: Uncommon Link.EXE Parent Process
2id: 6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6
3status: test
4description: |
5 Detects an uncommon parent process of "LINK.EXE".
6 Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.
7 Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity.
8 This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location.
9 By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.
10references:
11 - https://twitter.com/0gtweet/status/1560732860935729152
12author: Nasreddine Bencherchali (Nextron Systems)
13date: 2022-08-22
14modified: 2024-06-27
15tags:
16 - attack.defense-evasion
17 - attack.t1218
18logsource:
19 category: process_creation
20 product: windows
21detection:
22 selection:
23 Image|endswith: '\link.exe'
24 CommandLine|contains: 'LINK /' # Hardcoded command line when we call tools like dumpbin.exe, editbin.exe, lib.exe...etc
25 # Add other filters for other legitimate locations
26 filter_main_visual_studio:
27 ParentImage|startswith:
28 - 'C:\Program Files\Microsoft Visual Studio\'
29 - 'C:\Program Files (x86)\Microsoft Visual Studio\'
30 ParentImage|contains:
31 - '\VC\bin\'
32 - '\VC\Tools\'
33 condition: selection and not 1 of filter_main_*
34falsepositives:
35 - Unknown
36level: medium
References
Related rules
- Abusing Print Executable
- AddinUtil.EXE Execution From Uncommon Directory
- AgentExecutor PowerShell Execution
- Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
- Arbitrary File Download Via IMEWDBLD.EXE