CatalogLOLBAS

LOL · OtherMSBinary

VSDiagnostics.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Starts a collection session with sessionID 1 and calls kernelbase.CreateProcessW to launch specified executable.

Use Proxy execution of binary

VSDiagnostics.exe start 1 /launch:{PATH:.exe}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1127

Execute

ExecutionWindows

Starts a collection session with sessionID 2 and calls kernelbase.CreateProcessW to launch specified executable. Arguments specified in launchArgs are passed to CreateProcessW.

Use Proxy execution of binary with arguments

VSDiagnostics.exe start 2 /launch:{PATH:.exe} /launchArgs:"{CMD:args}"
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute
MITRE
T1127