LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

Devtoolslauncher.exe

View source

Binary will execute specified binary. Part of VS/VScode installation.

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1127

The above binary will execute other binary.

COMMAND
devtoolslauncher.exe LaunchForDeploy {PATH_ABSOLUTE:.exe} "{CMD:args}" test
USE CASE
Execute any binary with given arguments and it will call `developertoolssvc.exe`. `developertoolssvc` is actually executing the binary.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · CMD
EXAMPLE 02T1127

The above binary will execute other binary.

COMMAND
devtoolslauncher.exe LaunchForDebug {PATH_ABSOLUTE:.exe} "{CMD:args}" test
USE CASE
Execute any binary with given arguments.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · CMD
02 / ON DISK

Known paths

c:\windows\system32\devtoolslauncher.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    DeveloperToolsSvc.exe spawned an unknown process

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

felamos@_felamos