public-mirrors/LOLBAS
1
0
Fork 0
mirror of https://github.com/LOLBAS-Project/LOLBAS synced 2024-10-22 16:49:11 +02:00
Code Issues Projects Releases Wiki Activity

VSDiagnostics Execute lolbin (#309)

Browse Source 
Co-authored-by: Wietze <wietze@users.noreply.github.com>
This commit is contained in:
Bobby Cooke 2023-08-05 09:18:48 -07:00 committed by GitHub
parent e4c2371a26
commit fe64c63211
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 29 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
yml/OtherMSBinaries/VSDiagnostics.yml Normal file
View File

@ -0,0 +1,29 @@
---
Name: VSDiagnostics.exe
Description: Command-line tool used for performing diagnostics.
Author: Bobby Cooke
Created: 2023-07-12
Commands:
- Command: VSDiagnostics.exe start 1 /launch:calc.exe
Description: Starts a collection session with sessionID 1 and calls kernelbase.CreateProcessW to launch specified executable.
Usecase: Proxy execution of binary
Category: Execute
Privileges: User
MitreID: T1127
OperatingSystem: Windows 10, Windows 11
- Command: VSDiagnostics.exe start 2 /launch:cmd.exe /launchArgs:"/c calc.exe"
Description: Starts a collection session with sessionID 2 and calls kernelbase.CreateProcessW to launch specified executable. Arguments specified in launchArgs are passed to CreateProcessW.
Usecase: Proxy execution of binary with arguments
Category: Execute
Privileges: User
MitreID: T1127
OperatingSystem: Windows 10, Windows 11
Full_Path:
- Path: C:\Program Files\Microsoft Visual Studio\2022\Community\Team Tools\DiagnosticsHub\Collector\VSDiagnostics.exe
Detection:
- Sigma: https://github.com/tsale/Sigma_rules/blob/d5b4a09418edfeeb3a2d654f556d5bca82003cd7/LOL_BINs/VSDiagnostics_LoLBin.yml
Resources:
- Link: https://twitter.com/0xBoku/status/1679200664013135872
Acknowledgement:
- Person: Bobby Cooke
Handle: '@0xBoku'