Detectionhightest

Devtoolslauncher.exe Executes Specified Binary

The Devtoolslauncher.exe executes other binary

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Beyu Denis, oscd.community, @_felamosCreated Sat Oct 12Updated Sat Nov 27cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: '\devtoolslauncher.exe'
        CommandLine|contains: 'LaunchForDeploy'
    condition: selection

False Positives

Legitimate use of devtoolslauncher.exe by legitimate user

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6

Status

test

Level

high

Type

Detection

Created

Sat Oct 12

Modified

Sat Nov 27

Author

Path

rules/windows/process_creation/proc_creation_win_lolbin_devtoolslauncher.yml

Raw Tags

attack.defense-evasionattack.t1218