Title:Suspicious Vsls-Agent Command With AgentExtensionPath Load Status:test Description:Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter References: -https://twitter.com/bohops/status/1583916360404729857 Author: bohops Date: 2022-10-30 modified:None Tags:
-'attack.stealth'
-'attack.t1218'
Logsource:
category: process_creation
product: windows
Detection: selection: Image|endswith:
'\vsls-agent.exe' CommandLine|contains:
'--agentExtensionPath' filter: CommandLine|contains:
'Microsoft.VisualStudio.LiveShare.Agent.' condition:selection and not filter Falsepositives:
-False positives depend on custom use of vsls-agent.exe Level:medium
