.. /VSIISExeLauncher.exe

Star

Paths:

• C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\Common7\IDE\Extensions\Microsoft\Web Tools\ProjectSystem\VSIISExeLauncher.exe

Resources:

• https://github.com/timwhitez

Acknowledgements:

• timwhite

Detections:

• Sigma: proc_creation_win_lolbin_vsiisexelauncher.yml
• IOC: VSIISExeLauncher.exe spawned an unknown process

Execute

1. The above binary will execute other binary.

   VSIISExeLauncher.exe -p file.exe -a "/arg1 /arg2"

   Use case

   Execute any binary with given arguments.

   Privileges required

   User

   Operating systems

   Windows 10 and up with VS/VScode installed

   ATT&CK® technique

   T1218: System Binary Proxy Execution

   Tags

   Execute: EXE