VSTest.Console.exe is the command-line tool to run tests Located at: C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe; C:\Program Files (x86)\Microsoft Visual Studio\2022\TestAgent\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe.
vstest-consolevstest-consoleSandbox: execFile · Timeout: 30s
security.defense-evasion.bypass Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
VSTest functionality may allow an adversary to executes their malware by wrapping it as a test method then build it to a .exe or .dll file to be later run by vstest.console.exe. This may both allow AWL bypass or defense bypass in general (Proxy Execution and AWL bypass, Adversaries may run malicious code embedded inside the test methods of crafted dll/exe)
vstest.console.exe {PATH:.dll}| Type | Rule / Indicator |
|---|---|
| ioc | vstest.console.exe spawning unexpected processes |
vstest-console is a Windows LOLBin. VSTest.Console.exe is the command-line tool to run tests Located at: C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe; C:\Program Files (x86)\Microsoft Visual Studio\2022\TestAgent\Common7\IDE\CommonExtensions\Microsoft\TestWindow\vstest.console.exe.