Windows Process Creation: VSIISExeLauncher.exe Used with -p and -a Parameters

Flags Windows launches of VSIISExeLauncher.exe with "-p" and "-a" parameters, consistent with potential arbitrary binary execution.

FreeUnreviewedSigmamediumv1

windows-process-creation-vsiisexelauncher-exe-used-with-p-and-a-parameters-18749301

title: "Windows Process Creation: VSIISExeLauncher.exe Used with -p and -a Parameters"
id: 47c8b87d-15ae-44c6-817e-74e6fd56b56b
status: test
description: This rule identifies instances where the Windows binary VSIISExeLauncher.exe is launched with command-line parameters containing both " -p " and " -a ". VSIISExeLauncher.exe is part of Visual Studio/VS Code tooling and can be abused to execute arbitrary binaries, so parameterized execution is a useful indicator of suspicious activity. The detection relies on Windows process creation telemetry, matching the process image name and original file name along with the presence of specific command-line arguments.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/VSIISExeLauncher/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \VSIISExeLauncher.exe
    - OriginalFileName: VSIISExeLauncher.exe
  selection_cli:
    CommandLine|contains:
      - " -p "
      - " -a "
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 18749301-f1c5-4efc-a4c3-276ff1f5b6f8
    type: derived

What it detects

This rule identifies instances where the Windows binary VSIISExeLauncher.exe is launched with command-line parameters containing both " -p " and " -a ". VSIISExeLauncher.exe is part of Visual Studio/VS Code tooling and can be abused to execute arbitrary binaries, so parameterized execution is a useful indicator of suspicious activity. The detection relies on Windows process creation telemetry, matching the process image name and original file name along with the presence of specific command-line arguments.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.