vsjitdebugger.exe

type: OtherMSBinaries

Just-In-Time (JIT) debugger included with Visual Studio

Full path

c:\windows\system32\vsjitdebugger.exe

Commands

ExecuteUser T1127
Execution of local PE file as a subprocess of Vsjitdebugger.exe.
```
Vsjitdebugger.exe {PATH:.exe}
```
Executes specified executable as a subprocess of Vsjitdebugger.exe.
os: Windows
Execute: EXE

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml

Resources

https://twitter.com/pabraeken/status/990758590020452353

acknowledgement: Pierre-Alexandre Braeken @pabraeken