Windows

Launch-VsDevShell.ps1Launch-VsDevShell.ps1

Platform
Windows
Abuse functions
2
Mapped techniques
1

Description

Launch-VsDevShell.ps1 is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute. Mapped ATT&CK techniques (per LOLBAS / GTFOBins → MITRE crosswalk): T1218. Defenders should monitor execution of Launch-VsDevShell.ps1 under non-administrative or sudo contexts and alert when its arguments match the abuse-function signatures.

Abuse functions· 2

ExecuteT1216

Proxy execution

ExecuteT1216

Proxy execution

MITRE ATT&CK techniques· 1

T1216

Uses1

TypeTargetConfidenceTier
TechniqueSystem Script Proxy Executiont1216100%live

Abuses1

TypeTargetConfidenceTier
TechniqueSystem Binary Proxy Executiont121885%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

LOLbin
Devtoolslauncher.exe
LOLbin
CL_Invocation.ps1
LOLbin
CL_LoadAssembly.ps1
LOLbin
UtilityFunctions.ps1
LOLbin
VSLaunchBrowser.exe
LOLbin
VSDiagnostics.exe
Sourced from LOLBAS Project. Curated by Adam Lundqvist, SQUR.