Detection rules › Sigma

Launch-VsDevShell.PS1 Proxy Execution

Severity
medium
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1216.001 System Script Proxy Execution: PubPrn

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: all of selection_script

CommandLine|contains: Launch-VsDevShell.ps1

Stage 2: all of selection_flags

or:
CommandLine|contains: 'VsInstallationPath '
CommandLine|contains: 'VsWherePath '

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • Launch-VsDevShell.ps1
  • VsInstallationPath
  • VsWherePath