Malicious PE Execution by Microsoft Visual Studio Debugger

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package.