VSIISExeLauncher.exe

The above binary will execute other binary.

Use Execute any binary with given arguments.

VSIISExeLauncher.exe -p {PATH:.exe} -a "{CMD:args}"

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/19396788dbedc57249a46efed2bb1927abc376d4/rules/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml

IOC: VSIISExeLauncher.exe spawned an unknown process

Refs

github.com/timwhitez

lolbas-project.github.io/lolbas/OtherMSBinaries/VSIISExeLauncher/