Binary will execute specified binary. Part of VS/VScode installation.
devtoolslauncher.exe LaunchForDeploy [PATH_TO_BIN] "argument here" test
The above binary will execute other binary.
Execute any binary with given arguments and it will call developertoolssvc.exe. developertoolssvc is actually executing the binary. https://i.imgur.com/Go7rc0I.png
c:\windows\system32\devtoolslauncher.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_devtoolslauncher.yml, IOC: DeveloperToolsSvc.exe spawned an unknown process
felamos (@_felamos)