VSIISExeLauncher.exe

type: OtherMSBinaries

Binary will execute specified binary. Part of VS/VScode installation.

Full path

C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\IDE\Extensions\Microsoft\Web Tools\ProjectSystem\VSIISExeLauncher.exe

Commands

ExecuteUser T1218
Execute any binary with given arguments.
```
VSIISExeLauncher.exe -p {PATH:.exe} -a "{CMD:args}"
```
The above binary will execute other binary.
os: Windows 10 and up with VS/VScode installed
Execute: EXE

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml
IOCVSIISExeLauncher.exe spawned an unknown process

Resources

https://github.com/timwhitez

acknowledgement: timwhite