windows enabled community high v1.0.0

microsoft-nodejstools-pressanykey

Part of the NodeJS Visual Studio tools. Located at: C:\Program Files\Microsoft Visual Studio\<version>\Community\Common7\IDE\Extensions\Microsoft\NodeJsTools\NodeJsTools\Microsoft.NodejsTools.PressAnyKey.exe; C:\Program Files (x86)\Microsoft Visual Studio\<version>\Community\Common7\IDE\Extensions\Microsoft\NodeJsTools\NodeJsTools\Microsoft.NodejsTools.PressAnyKey.exe.

📋 Live Preview 
microsoft-nodejstools-pressanykey
microsoft-nodejstools-pressanykey

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Launch specified executable as a subprocess of Microsoft.NodejsTools.PressAnyKey.exe. (Spawn a new process via Microsoft.NodejsTools.PressAnyKey.exe.)

Microsoft.NodejsTools.PressAnyKey.exe normal 1 {PATH:.exe}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_renamed_pressanykey.yml
sigma https://github.com/SigmaHQ/sigma/blob/b02e3b698afbaae143ac4fb36236eb0b41122ed7/rules/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml

Documentation

microsoft-nodejstools-pressanykey

microsoft-nodejstools-pressanykey is a Windows LOLBin. Part of the NodeJS Visual Studio tools. Located at: C:\Program Files\Microsoft Visual Studio<version>\Community\Common7\IDE\Extensions\Microsoft\NodeJsTools\NodeJsTools\Microsoft.NodejsTools.PressAnyKey.exe; C:\Program Files (x86)\Microsoft Visual Studio<version>\Community\Common7\IDE\Extensions\Microsoft\NodeJsTools\NodeJsTools\Microsoft.NodejsTools.PressAnyKey.exe.

References