LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

vsls-agent.exe

View source

Agent for Visual Studio Live Share (Code Collaboration)

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Load a library payload using the --agentExtensionPath parameter (32-bit)

COMMAND
vsls-agent.exe --agentExtensionPath {PATH_ABSOLUTE:.dll}
USE CASE
Execute proxied payload with Microsoft signed binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 10 21H2 (likely previous and newer versions with modern versions of Visual Studio installed)
Execute · DLL
02 / ON DISK

Known paths

c:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\Common7\IDE\Extensions\Microsoft\LiveShare\Agent\vsls-agent.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Jimmy@bohops