Malicious PE Execution by Microsoft Visual Studio Debugger — Sigma Rule

Rule metadata and linked tags

Author: Agro (@agro_sev), Ensar Şamil (@sblmsrsn), oscd.community. Source status: test; severity: medium. Source dates: 2020-10-14 / 2022-10-09.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 866d53daca7795d144433039d2e525e2a93b5b70903ff83b8b58bf75305038e3

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Malicious PE Execution by Microsoft Visual Studio Debugger
id: 15c7904e-6ad1-4a45-9b46-5fb25df37fd2
status: test
description: |
  There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger.
  This option may be used adversaries to execute malicious code by signed verified binary.
  The debugger is installed alongside with Microsoft Visual Studio package.
references:
    - https://twitter.com/pabraeken/status/990758590020452353
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vsjitdebugger/
    - https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019
author: Agro (@agro_sev), Ensar Şamil (@sblmsrsn), oscd.community
date: 2020-10-14
modified: 2022-10-09
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\vsjitdebugger.exe'
    reduction1:
        Image|endswith: '\vsimmersiveactivatehelper*.exe'
    reduction2:
        Image|endswith: '\devenv.exe'
    condition: selection and not (reduction1 or reduction2)
falsepositives:
    - The process spawned by vsjitdebugger.exe is uncommon.
level: medium

Original YAML and metadata in JSON

False positives

• The process spawned by vsjitdebugger.exe is uncommon.

Source references

• https://twitter.com/pabraeken/status/990758590020452353
• https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vsjitdebugger/
• https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019