~/bokkapig
hack the box machine writeups

vstest.console.exe

type: OtherMSBinaries
VSTest.Console.exe is the command-line tool to run tests

Full path

C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe
C:\Program Files (x86)\Microsoft Visual Studio\2022\TestAgent\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe

Commands

  1. AWL BypassUser T1127

    Proxy Execution and AWL bypass, Adversaries may run malicious code embedded inside the test methods of crafted dll/exe

    vstest.console.exe {PATH:.dll}

    VSTest functionality may allow an adversary to executes their malware by wrapping it as a test method then build it to a .exe or .dll file to be later run by vstest.console.exe. This may both allow AWL bypass or defense bypass in general

    os: Windows 10, Windows 11

    Execute: DLL

Detection

  • IOCvstest.console.exe spawning unexpected processes

Code samples

Resources

acknowledgement: Onat Uzunyayla, Ayberk Halac