Devtoolslauncher.exe Executes Specified Binary

calendar Mar 5, 2023 · attack.defense_evasion attack.t1218  ·
Share on: linkedin copy

The Devtoolslauncher.exe executes other binary

Sigma rule (View on GitHub)

 1title: Devtoolslauncher.exe Executes Specified Binary
 2id: cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6
 3status: test
 4description: The Devtoolslauncher.exe executes other binary
 5references:
 6    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devtoolslauncher/
 7    - https://twitter.com/_felamos/status/1179811992841797632
 8author: Beyu Denis, oscd.community (rule), @_felamos (idea)
 9date: 2019/10/12
10modified: 2021/11/27
11tags:
12    - attack.defense_evasion
13    - attack.t1218
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection:
19        Image|endswith: '\devtoolslauncher.exe'
20        CommandLine|contains: 'LaunchForDeploy'
21    condition: selection
22falsepositives:
23    - Legitimate use of devtoolslauncher.exe by legitimate user
24level: high

References

  • Devtoolslauncher | LOLBAS

    The above binary will execute other binary. devtoolslauncher.exe LaunchForDeploy [PATH_TO_BIN] "argument here" test Use caseExecute any binary with given arguments and it will call developertoolssv...


    Read More

  • Something went wrong, but don’t fret — let’s give it another shot.


    Read More

Related rules

to-top