vsls-agent.exe

type: OtherMSBinaries

Agent for Visual Studio Live Share (Code Collaboration)

Full path

c:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\Common7\IDE\Extensions\Microsoft\LiveShare\Agent\vsls-agent.exe

Commands

ExecuteUser T1218
Execute proxied payload with Microsoft signed binary
```
vsls-agent.exe --agentExtensionPath {PATH_ABSOLUTE:.dll}
```
Load a library payload using the –agentExtensionPath parameter (32-bit)
os: Windows 10 21H2 (likely previous and newer versions with modern versions of Visual Studio installed)
Execute: DLL

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml

Resources

https://twitter.com/bohops/status/1583916360404729857

acknowledgement: Jimmy @bohops