public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2025-07-27 12:42:19 +02:00
Code Issues Projects Releases Wiki Activity

Add vsls-agent lolbin and committing a few other changes (#263)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
bohops
2023-02-25 13:47:44 -05:00
committed by GitHub
parent ded90467a8
commit cd16f0aff3
6 changed files with 35 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
yml/OtherMSBinaries/vsls-agent.yml Normal file
View File

@@ -0,0 +1,22 @@
---
Name: vsls-agent.exe
Description: Agent for Visual Studio Live Share (Code Collaboration)
Author: Jimmy (@bohops)
Created: 2022-11-01
Commands:
- Command: vsls-agent.exe --agentExtensionPath c:\path\to\payload.dll
Description: Load a library payload using the --agentExtensionPath parameter (32-bit)
Usecase: Execute proxied payload with Microsoft signed binary
Category: Execute
Privileges: User
MitreID: T1218
OperatingSystem: Windows 10 21H2 (likely previous and newer versions with modern versions of Visual Studio installed)
Full_Path:
- Path: c:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\Common7\IDE\Extensions\Microsoft\LiveShare\Agent\vsls-agent.exe
Detection:
- Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_vslsagent_agentextensionpath_load.yml
Resources:
- Link: https://twitter.com/bohops/status/1583916360404729857
Acknowledgement:
- Person: Jimmy
Handle: '@bohops'