Windows Devtoolslauncher.exe Launches Specified Binary via LaunchForDeploy

Alerts when devtoolslauncher.exe runs with LaunchForDeploy, indicating it may launch another binary on Windows.

FreeUnreviewedSigmahighv1

windows-devtoolslauncher-exe-launches-specified-binary-via-launchfordeploy-cc268ac1

title: Windows Devtoolslauncher.exe Launches Specified Binary via LaunchForDeploy
id: ce70e00a-802c-4ce5-bc10-fbd4bf1fe253
status: test
description: This rule flags process creation events where devtoolslauncher.exe is launched with a command line containing LaunchForDeploy. Devtoolslauncher is an application binary that can be used to execute or launch other binaries, which can support stealthy execution patterns. The detection relies on Windows process creation telemetry, matching the process image path ending with devtoolslauncher.exe and a specific command-line substring.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devtoolslauncher/
  - https://twitter.com/_felamos/status/1179811992841797632
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_devtoolslauncher.yml
author: Beyu Denis, oscd.community (rule), @_felamos (idea), Huntrule Team
date: 2019-10-12
modified: 2021-11-27
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \devtoolslauncher.exe
    CommandLine|contains: LaunchForDeploy
  condition: selection
falsepositives:
  - Legitimate use of devtoolslauncher.exe by legitimate user
level: high
license: DRL-1.1
related:
  - id: cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6
    type: derived

What it detects

This rule flags process creation events where devtoolslauncher.exe is launched with a command line containing LaunchForDeploy. Devtoolslauncher is an application binary that can be used to execute or launch other binaries, which can support stealthy execution patterns. The detection relies on Windows process creation telemetry, matching the process image path ending with devtoolslauncher.exe and a specific command-line substring.

Known false positives

Legitimate use of devtoolslauncher.exe by legitimate user

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.