title: NodejsTools PressAnyKey Lolbin
id: a20391f8-76fb-437b-abc0-dba2df1952c6
status: experimental
description: Detects a certain command line flag combination used by Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary
references:
    - https://twitter.com/mrd0x/status/1463526834918854661
tags:
    - attack.execution
    - attack.defense_evasion
    - attack.t1218
author: Florian Roth
date: 2022/01/11
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains: 'Microsoft.NodejsTools.PressAnyKey.exe normal '
    selection2:
        CommandLine|contains: '.exe normal '
        CommandLine|endswith: '.exe'
    filter:
        Image|contains: '\Microsoft\NodeJsTools\NodeJsTools'
    condition: 1 of selection* and not 1 of filter*
falsepositives:
    - Other tools with the same command line flag combination
    - Legitimate uses as part of Visual Studio development
level: high