Unusual Link.EXE Parent Process (via process_creation)

title: Unusual Link.EXE Parent Process (via process_creation)
id: 25e60e57-ce17-58a4-8082-4c80bbc45509
status: stable
description: This rule detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation. Multiple utilities frequently found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity. This would enable an adversary to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location. By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be anomalous or malicious.
references:
    - https://attack.mitre.org/techniques/T1218/
    - https://twitter.com/0gtweet/status/1560732860935729152
author: Huntrule Team
date: 2026-07-27
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\link.exe'
        CommandLine|contains: 'LINK /'
    filter_main_visual_studio:
        ParentImage|startswith:
            - 'C:\Program Files\Microsoft Visual Studio\'
            - 'C:\Program Files (x86)\Microsoft Visual Studio\'
        ParentImage|contains:
            - '\VC\bin\'
            - '\VC\Tools\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium