VSIISExeLauncher.exe Proxy Execution
This rule detects the execution of "VSIISExeLauncher.exe", a legitimate binary associated with Visual Studio/VS Code, when it is used to launch other executables. Adversaries may abuse this utility to proxy execution of malicious payloads, potentially bypassing application control solutions. The detection specifically looks for the execution of VSIISExeLauncher.exe combined with command-line arguments indicating the launch of another program (e.g., using '-p' or '-a').
Sigma
