Bind Link Creation Redirecting a DLL Path via bindutil --link
Detects the use of the bindutil utility to create a link or redirection for a DLL path. This behavior is often associated with modifying search paths or redirecting DLL dependencies in container or virtualization environments. The rule excludes common, legitimate system and container processes that use bindutil for path management.
Sigma
