Windows PowerShell: Launch-VsDevShell.ps1 Proxy Command Execution

Detects command-line usage of Launch-VsDevShell.ps1 with Visual Studio path flags on Windows.

FreeUnreviewedSigmamediumv1

windows-powershell-launch-vsdevshell-ps1-proxy-command-execution-45d3a03d

title: "Windows PowerShell: Launch-VsDevShell.ps1 Proxy Command Execution"
id: d9ba682a-ae7e-4855-89e6-4f600e5d099f
status: test
description: This rule flags Windows process creations where the command line contains the Microsoft signed script name Launch-VsDevShell.ps1 and also includes Visual Studio path-related flags. Attackers can abuse this proxy script to run commands while blending into developer tooling behavior. The detection relies on process creation telemetry and specific command-line substrings indicating use of the script and its typical parameters.
references:
  - https://twitter.com/nas_bench/status/1535981653239255040
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_launch_vsdevshell.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-19
tags:
  - attack.stealth
  - attack.t1216.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_script:
    CommandLine|contains: Launch-VsDevShell.ps1
  selection_flags:
    CommandLine|contains:
      - "VsWherePath "
      - "VsInstallationPath "
  condition: all of selection_*
falsepositives:
  - Legitimate usage of the script by a developer
level: medium
license: DRL-1.1
related:
  - id: 45d3a03d-f441-458c-8883-df101a3bb146
    type: derived

What it detects

This rule flags Windows process creations where the command line contains the Microsoft signed script name Launch-VsDevShell.ps1 and also includes Visual Studio path-related flags. Attackers can abuse this proxy script to run commands while blending into developer tooling behavior. The detection relies on process creation telemetry and specific command-line substrings indicating use of the script and its typical parameters.

Known false positives

Legitimate usage of the script by a developer

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.