Title:Use of VSIISExeLauncher.exe Status:test Description:The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries References: -https://lolbas-project.github.io/lolbas/OtherMSBinaries/VSIISExeLauncher/ Author: Nasreddine Bencherchali (Nextron Systems) Date: 2022-06-09 modified:None Tags:
-'attack.execution'
-'attack.stealth'
-'attack.t1127'
Logsource:
category: process_creation
product: windows
Detection: selection_img: Image|endswith:'\VSIISExeLauncher.exe'OriginalFileName:'VSIISExeLauncher.exe'selection_cli: CommandLine|contains: -' -p ' -' -a '
condition:all of selection* Falsepositives:
-Unknown Level:medium
