Malicious PE Execution by Microsoft Visual Studio Debugger (via process_creation)

title: Malicious PE Execution by Microsoft Visual Studio Debugger (via process_creation)
id: c334834b-e5e8-592b-8147-ec71e6d37a81
status: stable
description: This rule detects there is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger. This option may be used threat actors to execute hostile code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package.
references:
    - https://attack.mitre.org/techniques/T1218/
    - https://twitter.com/pabraeken/status/990758590020452353
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vsjitdebugger/
    - https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019
author: Huntrule Team
date: 2026-04-15
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\vsjitdebugger.exe'
    reduction1:
        Image|endswith: '\vsimmersiveactivatehelper*.exe'
    reduction2:
        Image|endswith: '\devenv.exe'
    condition: selection and not (reduction1 or reduction2)
falsepositives:
    - Unknown
level: medium