Potential Binary Proxy Execution Via VSDiagnostics.EXE

Title: Potential Binary Proxy Execution Via VSDiagnostics.EXE
Status: test
Description:Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.
References:
  -https://twitter.com/0xBoku/status/1679200664013135872
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-03
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\VSDiagnostics.exe' OriginalFileName:'VSDiagnostics.exe'   selection_cli_start:
    CommandLine|contains: 'start'
  selection_cli_launch:
    CommandLine|contains:
      -' /launch:'
      -' -launch:'

  condition:all of selection_*
Falsepositives:
  -Legitimate usage for tracing and diagnostics purposes
Level: medium