Detection rules › Sigma
Launch-VsDevShell.PS1 Proxy Execution
Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.
Known false positives
- Legitimate usage of the script by a developer
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: Launch-VsDevShell.PS1 Proxy Execution
id: 45d3a03d-f441-458c-8883-df101a3bb146
status: test
description: Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.
references:
- https://twitter.com/nas_bench/status/1535981653239255040
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-19
tags:
- attack.stealth
- attack.t1216.001
logsource:
category: process_creation
product: windows
detection:
selection_script:
CommandLine|contains: 'Launch-VsDevShell.ps1'
selection_flags:
CommandLine|contains:
- 'VsWherePath '
- 'VsInstallationPath '
condition: all of selection_*
falsepositives:
- Legitimate usage of the script by a developer
level: medium
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_script
selection_script:
CommandLine|contains: 'Launch-VsDevShell.ps1'
Stage 2: selection_flags
selection_flags:
CommandLine|contains:
- 'VsWherePath '
- 'VsInstallationPath '
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |