Identifier / Programs / Windows
devtoolslauncher.exe
LOLBAS Execute 1 Sigma rule name it 2 ATT&CK techniques 2 documented commands
How devtoolslauncher.exe is abused
Execute T1127 Trusted Developer Utilities Proxy Execution
launchfordeploy test
Execute T1127 Trusted Developer Utilities Proxy Execution
launchfordebug test
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for devtoolslauncher.exe.
2 documented commands
Execute T1127 Trusted Developer Utilities Proxy Execution User privileges
The above binary will execute other binary.
devtoolslauncher.exe LaunchForDeploy {PATH_ABSOLUTE:.exe} "{CMD:args}" testTrips 1 Sigma rule: highDevtoolslauncher.exe Executes Specified Binary by Beyu Denis, oscd.community (rule), @_felamos (idea)
Execute T1127 Trusted Developer Utilities Proxy Execution User privileges
The above binary will execute other binary.
devtoolslauncher.exe LaunchForDebug {PATH_ABSOLUTE:.exe} "{CMD:args}" testTrips no Sigma process-creation rule.
1 of the 2 commands the identifier reads trips a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for devtoolslauncher.exe, by felamos, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for devtoolslauncher.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.