Launch-VsDevShell.PS1 Proxy Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

Detects the execution of the Microsoft-signed PowerShell script 'Launch-VsDevShell.ps1' with specific command-line arguments ('VsWherePath ' or 'VsInstallationPath '). This script can be abused to proxy the execution of other commands, potentially for defense evasion.