LOL · OtherMSBinary

VSDiagnostics.exe

2 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Starts a collection session with sessionID 1 and calls kernelbase.CreateProcessW to launch specified executable.

Use Proxy execution of binary

VSDiagnostics.exe start 1 /launch:{PATH:.exe}

Context: user
Native: Execute
MITRE: T1127
Detection: Sigma: github.com/tsale/Sigma_rules/blob/d5b4a09418edfeeb3a2d654f556d5bca82003cd7/LOL_BINs/VSDiagnostics_LoLBin.yml
Refs: twitter.com/0xBoku/status/1679200664013135872
lolbas-project.github.io/lolbas/OtherMSBinaries/VSDiagnostics/

Execute

Execution Windows

Starts a collection session with sessionID 2 and calls kernelbase.CreateProcessW to launch specified executable. Arguments specified in launchArgs are passed to CreateProcessW.

Use Proxy execution of binary with arguments

VSDiagnostics.exe start 2 /launch:{PATH:.exe} /launchArgs:"{CMD:args}"

Context: user
Native: Execute
MITRE: T1127
Detection: Sigma: github.com/tsale/Sigma_rules/blob/d5b4a09418edfeeb3a2d654f556d5bca82003cd7/LOL_BINs/VSDiagnostics_LoLBin.yml
Refs: twitter.com/0xBoku/status/1679200664013135872
lolbas-project.github.io/lolbas/OtherMSBinaries/VSDiagnostics/