Rapuncel: vsdbg.exe Spawning Non-Microsoft Child Processes

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

Detects instances where the Visual Studio Debugger (vsdbg.exe) spawns a child process that is not expected, such as common VS diagnostic tools or standard Microsoft/Windows binaries. This is used to identify potential process injection or abuse of the debugger for executing unauthorized payloads.