Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution
This rule detects when `Microsoft.NodejsTools.PressAnyKey.exe` spawns a child process. This executable is part of Visual Studio's Node.js tools and is designed to pause execution until a key is pressed. However, it can be abused to proxy the execution of arbitrary binaries, allowing an attacker to bypass certain security controls or execute malicious code under the guise of a legitimate Visual Studio component.
Sigma
