huntrule

Windows Process Creation: Uncommon Parent Process for link.exe

Alerts when link.exe is spawned with a parent process outside typical Visual Studio paths.

FreeUnreviewedSigmamediumv1
title: "Windows Process Creation: Uncommon Parent Process for link.exe"
id: 8444a726-e274-41d4-a678-a6e020d7fa86
status: test
description: This rule flags process creation events where link.exe is launched, but its parent process path is not within common Microsoft Visual Studio locations. Attackers may exploit this by causing a tool to invoke a different link.exe from an unexpected directory (e.g., via renamed or sideloaded binaries). The detection relies on process creation telemetry including Image and CommandLine for link.exe and ParentImage for the launching process.
references:
  - https://twitter.com/0gtweet/status/1560732860935729152
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_link_uncommon_parent_process.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-22
modified: 2024-06-27
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \link.exe
    CommandLine|contains: LINK /
  filter_main_visual_studio:
    ParentImage|startswith:
      - C:\Program Files\Microsoft Visual Studio\
      - C:\Program Files (x86)\Microsoft Visual Studio\
    ParentImage|contains:
      - \VC\bin\
      - \VC\Tools\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6
    type: derived

What it detects

This rule flags process creation events where link.exe is launched, but its parent process path is not within common Microsoft Visual Studio locations. Attackers may exploit this by causing a tool to invoke a different link.exe from an unexpected directory (e.g., via renamed or sideloaded binaries). The detection relies on process creation telemetry including Image and CommandLine for link.exe and ParentImage for the launching process.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.