LOL · Script

Launch-VsDevShell.ps1

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Execute binaries from the context of the signed script using the "VsWherePath" flag.

Use Proxy execution

powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsWherePath {PATH_ABSOLUTE:.exe}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1216
Detection: Sigma: github.com/SigmaHQ/sigma/blob/6199a703221a98ae6ad343c79c558da375203e4e/rules/windows/process_creation/proc_creation_win_lolbin_launch_vsdevshell.yml
Refs: twitter.com/nas_bench/status/1535981653239255040
lolbas-project.github.io/lolbas/Scripts/Launch-VsDevShell/

Execute

ExecutionWindows

Execute binaries and commands from the context of the signed script using the "VsInstallationPath" flag.

Use Proxy execution

powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsInstallationPath "/../../../../../; {PATH:.exe} ;"

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1216
Detection: Sigma: github.com/SigmaHQ/sigma/blob/6199a703221a98ae6ad343c79c558da375203e4e/rules/windows/process_creation/proc_creation_win_lolbin_launch_vsdevshell.yml
Refs: twitter.com/nas_bench/status/1535981653239255040
lolbas-project.github.io/lolbas/Scripts/Launch-VsDevShell/