Identifier / Programs / Windows
launch-vsdevshell.ps1
LOLBAS Execute 1 ATT&CK technique 2 documented commands
How launch-vsdevshell.ps1 is abused
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for launch-vsdevshell.ps1.
2 documented commands
Execute T1216 System Script Proxy Execution User privileges
Execute binaries from the context of the signed script using the "VsWherePath" flag.
powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsWherePath {PATH_ABSOLUTE:.exe}Trips 1 Sigma rule: mediumLaunch-VsDevShell.PS1 Proxy Execution by Nasreddine Bencherchali (Nextron Systems)
Execute T1216 System Script Proxy Execution User privileges
Execute binaries and commands from the context of the signed script using the "VsInstallationPath" flag.
powershell -ep RemoteSigned -f .\Launch-VsDevShell.ps1 -VsInstallationPath "/../../../../../; {PATH:.exe} ;"Trips 1 Sigma rule: mediumLaunch-VsDevShell.PS1 Proxy Execution by Nasreddine Bencherchali (Nextron Systems)
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for launch-vsdevshell.ps1, by Nasreddine Bencherchali, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for launch-vsdevshell.ps1. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.