Windows: vsls-agent.exe Executed With --agentExtensionPath Suspicious Library Load

Flags vsls-agent.exe launched with --agentExtensionPath, suggesting a potentially suspicious external extension/library load.

FreeUnreviewedSigmamediumv1

windows-vsls-agent-exe-executed-with-agentextensionpath-suspicious-library-load-43103702

title: "Windows: vsls-agent.exe Executed With --agentExtensionPath Suspicious Library Load"
id: 2f88ff69-ce98-4ba8-864e-a070726f9d68
status: test
description: This rule flags process creations where Microsoft Visual Studio vsls-agent.exe is launched with the --agentExtensionPath parameter, indicating an attempted external extension/library load. Attackers may use this execution pattern to load untrusted code or extend agent behavior while masquerading as a legitimate binary. The detection relies on process creation telemetry, specifically the executed image path ending in vsls-agent.exe and the command-line arguments containing --agentExtensionPath, with a reduction for cases referencing Microsoft.VisualStudio.LiveShare.Agent.
references:
  - https://twitter.com/bohops/status/1583916360404729857
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml
author: bohops, Huntrule Team
date: 2022-10-30
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \vsls-agent.exe
    CommandLine|contains: --agentExtensionPath
  filter:
    CommandLine|contains: Microsoft.VisualStudio.LiveShare.Agent.
  condition: selection and not filter
falsepositives:
  - False positives depend on custom use of vsls-agent.exe
level: medium
license: DRL-1.1
related:
  - id: 43103702-5886-11ed-9b6a-0242ac120002
    type: derived

What it detects

This rule flags process creations where Microsoft Visual Studio vsls-agent.exe is launched with the --agentExtensionPath parameter, indicating an attempted external extension/library load. Attackers may use this execution pattern to load untrusted code or extend agent behavior while masquerading as a legitimate binary. The detection relies on process creation telemetry, specifically the executed image path ending in vsls-agent.exe and the command-line arguments containing --agentExtensionPath, with a reduction for cases referencing Microsoft.VisualStudio.LiveShare.Agent.

Known false positives

False positives depend on custom use of vsls-agent.exe

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.