Devtoolslauncher.exe Executes Specified Binary

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects when 'devtoolslauncher.exe' is executed with the 'LaunchForDeploy' command-line argument. This behavior is indicative of 'devtoolslauncher.exe' being used to proxy the execution of another binary, which can be abused by adversaries for defense evasion.