Malicious PE Execution by Microsoft Visual Studio Debugger
This rule detects the execution of a new process where the parent process is `vsjitdebugger.exe`, the Microsoft Visual Studio Just-In-Time Debugger. Adversaries may abuse this legitimate, signed binary to proxy the execution of malicious code, thereby evading defenses that trust signed executables. The rule includes exclusions for common legitimate child processes of `vsjitdebugger.exe` to reduce false positives.
Sigma
