vstest.console.exe

VSTest functionality may allow an adversary to executes their malware by wrapping it as a test method then build it to a .exe or .dll file to be later run by vstest.console.exe. This may both allow AWL bypass or defense bypass in general

Use Proxy Execution and AWL bypass, Adversaries may run malicious code embedded inside the test methods of crafted dll/exe

vstest.console.exe {PATH:.dll}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

AWL Bypass

MITRE

T1127

Detection

IOC: vstest.console.exe spawning unexpected processes

Refs

learn.microsoft.com/en-us/visualstudio/test/vstest-console-options?view=vs-2022

lolbas-project.github.io/lolbas/OtherMSBinaries/vstest.console/