Detectionmediumtest
Suspicious Vsls-Agent Command With AgentExtensionPath Load
Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic2 selectors
detection:
selection:
Image|endswith: '\vsls-agent.exe'
CommandLine|contains: '--agentExtensionPath'
filter:
CommandLine|contains: 'Microsoft.VisualStudio.LiveShare.Agent.'
condition: selection and not filterFalse Positives
False positives depend on custom use of vsls-agent.exe
References
MITRE ATT&CK
Tactics
Techniques
Rule Metadata
Rule ID
43103702-5886-11ed-9b6a-0242ac120002
Status
test
Level
medium
Type
Detection
Created
Sun Oct 30
Author
Path
rules/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml
Raw Tags
attack.defense-evasionattack.t1218