windows enabled community high v1.0.0

vsls-agent

Agent for Visual Studio Live Share (Code Collaboration) Located at: c:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\Common7\IDE\Extensions\Microsoft\LiveShare\Agent\vsls-agent.exe.

📋 Live Preview 
vsls-agent
vsls-agent

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Load a library payload using the --agentExtensionPath parameter (32-bit) (Execute proxied payload with Microsoft signed binary)

vsls-agent.exe --agentExtensionPath {PATH_ABSOLUTE:.dll}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml

Documentation

vsls-agent

vsls-agent is a Windows LOLBin. Agent for Visual Studio Live Share (Code Collaboration) Located at: c:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\Common7\IDE\Extensions\Microsoft\LiveShare\Agent\vsls-agent.exe.

References