Launch-VsDevShell.PS1 Proxy Execution
Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.
Detection logic
selection_script
CommandLine|contains: Launch-VsDevShell.ps1selection_flags
CommandLine|contains:
- "VsWherePath "
- "VsInstallationPath "Condition
all of selection_*Raw YAML
title: Launch-VsDevShell.PS1 Proxy Execution
id: 45d3a03d-f441-458c-8883-df101a3bb146
status: test
description: Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.
references:
- https://twitter.com/nas_bench/status/1535981653239255040
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-19
tags:
- attack.stealth
- attack.t1216.001
logsource:
category: process_creation
product: windows
detection:
selection_script:
CommandLine|contains: 'Launch-VsDevShell.ps1'
selection_flags:
CommandLine|contains:
- 'VsWherePath '
- 'VsInstallationPath '
condition: all of selection_*
falsepositives:
- Legitimate usage of the script by a developer
level: mediumFalse positives
- Legitimate usage of the script by a developer