Elastic Defend high stable eql

Suspicious VSCode Extension Child Process

Detects when a vscode extension spawns an abnormal or suspicious child process. This activity can indicate that a malicious extension has been installed and is attempting to perform malicious actions on a user's system for initial access, data stealing, etc.

View Source

Detection Logic

process where event.action == "exec" and 
 (process.parent.executable like~ "/Users/*/.vscode/extensions/*" or process.Ext.effective_parent.executable like~ "/Users/*/.vscode/extensions/*") and
    (
     (process.name in ("sh", "bash", "zsh") and
	     process.args == "-c" and process.args like~ ("*curl*", "*nscurl*", "*osascript*", "*zip*")) or
	  
     (process.name in~ ("tclsh*", "osascript", "curl", "nscurl"))
    ) and not process.parent.code_signature.team_id in ("Q6L2SF6YDW", "2DC432GLL2", "W4NT6CRQ7U")

Field Validations

Loading…

Comments (0)

Loading comments...