{"id":"6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6","title":"Uncommon Link.EXE Parent Process","description":"Detects an uncommon parent process of \"LINK.EXE\".\nLink.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.\nMultiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the \"LINK.EXE\" binary without checking its validity.\nThis would allow an attacker to sideload any binary with the name \"link.exe\" if one of the aforementioned tools get executed from a different location.\nBy filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-22","modified":"2024-06-27","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://twitter.com/0gtweet/status/1560732860935729152"],"source_path":"rules/windows/process_creation/proc_creation_win_link_uncommon_parent_process.yml","source_sha256":"4658cdff0a56722fca9212229d6896bb7e7c956a9325869565e0787218a2e7c4","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_link_uncommon_parent_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Uncommon Link.EXE Parent Process\nid: 6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6\nstatus: test\ndescription: |\n    Detects an uncommon parent process of \"LINK.EXE\".\n    Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.\n    Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the \"LINK.EXE\" binary without checking its validity.\n    This would allow an attacker to sideload any binary with the name \"link.exe\" if one of the aforementioned tools get executed from a different location.\n    By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.\nreferences:\n    - https://twitter.com/0gtweet/status/1560732860935729152\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-22\nmodified: 2024-06-27\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\link.exe'\n        CommandLine|contains: 'LINK /' # Hardcoded command line when we call tools like dumpbin.exe, editbin.exe, lib.exe...etc\n    # Add other filters for other legitimate locations\n    filter_main_visual_studio:\n        ParentImage|startswith:\n            - 'C:\\Program Files\\Microsoft Visual Studio\\'\n            - 'C:\\Program Files (x86)\\Microsoft Visual Studio\\'\n        ParentImage|contains:\n            - '\\VC\\bin\\'\n            - '\\VC\\Tools\\'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6.json","kind":"sigma"}