Uncommon LINK.EXE Parent Process
This rule detects the execution of "LINK.EXE" with an uncommon parent process. LINK.EXE is a Microsoft incremental linker, typically bundled with Visual Studio. Other utilities like editbin.exe, dumpbin.exe, and lib.exe often hardcode calls to "LINK.EXE" without validating its path. This behavior can be exploited by an attacker to sideload a malicious binary named "link.exe" if one of these legitimate tools is executed from an unexpected location. The rule filters out known legitimate parent processes from Visual Studio installation paths to identify suspicious executions.
Sigma
