Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Malicious PE Execution by Microsoft Visual Studio Debugger

There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger. This option may be used adversaries to execute malicious code by signed verified binary. The debugger is installed alongside with Microsoft Visual Studio package.

ATT&CK coverage

Outside the enterprise matrix

T1218

Detection requirements

Log source product: windows
Log source category: process_creation

What the source says

What fires this without an attack behind it

The process spawned by vsjitdebugger.exe is uncommon.

References

https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019
https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vsjitdebugger/
https://twitter.com/pabraeken/status/990758590020452353

Tagged by the source as

attack.stealth

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.