Elastic Defend high stable eql

DLL Execution via Visual Studio Live Share

Identifies the use of the Windows Visual Studio Live Share binary to load a random DLL. Adversaries may leverage this utility to execute malicious code via a trusted Microsoft program.

View Source

Detection Logic

process where event.action == "start" and
  (process.name : "vsls-agent.exe" or process.pe.original_file_name : "vsls-agent.dll") and process.args : "--agentExtensionPath" and

  not (process.args : "--pipe" and process.args : "https://*.visualstudio.com/") and

  not process.parent.executable :
             ("?:\\Program Files\\Microsoft Visual Studio\\*\\IDE\\devenv.exe",
              "?:\\Program Files (x86)\\Microsoft Visual Studio\\*\\IDE\\devenv.exe")

Field Validations

Loading…

Comments (0)

Loading comments...