Launch-VsDevShell.PS1 Proxy Execution

Title: Launch-VsDevShell.PS1 Proxy Execution
Status: test
Description:Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.
References:
  -https://twitter.com/nas_bench/status/1535981653239255040
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1216.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_script:
    CommandLine|contains: 'Launch-VsDevShell.ps1'
  selection_flags:
    CommandLine|contains:
      -'VsWherePath '
      -'VsInstallationPath '

  condition:all of selection_*
Falsepositives:
  -Legitimate usage of the script by a developer
Level: medium