Suspicious Execution from VS Code Extension

  1[metadata]
  2creation_date = "2026/02/13"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/05/04"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects suspicious process execution launched from a VS Code extension context (parent command line contains
 11.vscode/extensions). Malicious extensions can run on startup and drop or execute payloads (e.g. RATs like
 12ScreenConnect, script interpreters, or download utilities). This covers both script/LOLBin children and
 13recently created executables from non-Program Files paths, as seen in campaigns such as the fake Clawdbot
 14extension that installed ScreenConnect RAT.
 15"""
 16from = "now-9m"
 17index = ["logs-endpoint.events.process-*"]
 18language = "eql"
 19license = "Elastic License v2"
 20name = "Suspicious Execution from VS Code Extension"
 21note = """## Triage and analysis
 22
 23### Investigating Suspicious Execution from VS Code Extension
 24
 25Malicious VS Code extensions can use `activationEvents: ["onStartupFinished"]` to run as soon as the editor starts, then spawn scripts or download-and-execute payloads (e.g. weaponized ScreenConnect, batch/PowerShell downloaders). This rule flags process starts whose parent command line indicates execution from the extension host under `.vscode\\extensions\\` (or `/.vscode/extensions/`).
 26
 27### Possible investigation steps
 28
 29- Identify the extension: from the parent process command line, extract the path under `.vscode\\extensions\\` to get the extension id (e.g. `publisher.name-version`).
 30- Check whether that extension is approved; search the VS Code marketplace (or internal registry) for the same name and compare hashes.
 31- Inspect the child process: if it is cmd/powershell/curl/node/rundll32/etc., review command line and network/file activity; if it is a recently created executable (e.g. Code.exe, Lightshot), check path (e.g. %TEMP%\\Lightshot) and code signature.
 32- Correlate with network events (C2 domains, Dropbox/URL downloads) and with [Fake Clawdbot VS Code Extension](https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware) IOCs if relevant.
 33
 34### False positive analysis
 35
 36- Legitimate extensions that run scripts or tools (e.g. linters, formatters, task runners) can spawn cmd, node, or PowerShell. Tune by excluding known extension ids or by requiring additional conditions (e.g. outbound to unknown IPs).
 37- Extension development: running/debugging an extension from a workspace will spawn processes from `.vscode\\extensions\\`; consider excluding dev machines or specific parent paths.
 38
 39### Response and remediation
 40
 41- Uninstall the suspicious extension and restart VS Code.
 42- If payload was executed: check for ScreenConnect (or similar) installation paths and services, remove persisted artifacts, block IOCs at firewall/DNS, rotate any API keys or secrets that may have been entered into the extension.
 43"""
 44
 45setup = """## Setup
 46
 47This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 48
 49Setup instructions: https://ela.st/install-elastic-defend
 50"""
 51
 52references = [
 53    "https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware",
 54    "https://attack.mitre.org/techniques/T1204/",
 55    "https://attack.mitre.org/techniques/T1195/002/",
 56]
 57risk_score = 47
 58rule_id = "c3d4e5f6-a7b8-6c9d-0e1f-2a3b4c5d6e7f"
 59severity = "medium"
 60tags = [
 61    "Domain: Endpoint",
 62    "OS: Windows",
 63    "Use Case: Threat Detection",
 64    "Tactic: Initial Access",
 65    "Tactic: Execution",
 66    "Data Source: Elastic Defend",
 67    "Resources: Investigation Guide",
 68]
 69timestamp_override = "event.ingested"
 70type = "eql"
 71
 72query = '''
 73process where host.os.type == "windows" and event.action == "start" and
 74  process.parent.name : ("node.exe", "Code.exe") and
 75  process.parent.command_line != null and
 76  process.parent.command_line : ("*vscode*extensions*", "*extensionHost*") and
 77  (
 78    process.name : (
 79      "cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "msiexec.exe",
 80      "curl.exe", "bitsadmin.exe", "wscript.exe", "cscript.exe", "mshta.exe",
 81      "node.exe"
 82    ) or
 83	
 84	// recently dropped PE
 85    process.Ext.relative_file_creation_time <= 500
 86  ) and 
 87  not (process.name : "cmd.exe" and process.args : ("npm.cmd config get prefix", "code -v", "chcp")) and 
 88  not (process.name : "python.exe" and process.parent.command_line : "*ms-python.vscode-*")
 89'''
 90
 91
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95
 96[[rule.threat.technique]]
 97id = "T1195"
 98name = "Supply Chain Compromise"
 99reference = "https://attack.mitre.org/techniques/T1195/"
100
101[[rule.threat.technique.subtechnique]]
102id = "T1195.002"
103name = "Compromise Software Supply Chain"
104reference = "https://attack.mitre.org/techniques/T1195/002/"
105
106[rule.threat.tactic]
107id = "TA0001"
108name = "Initial Access"
109reference = "https://attack.mitre.org/tactics/TA0001/"
110
111[[rule.threat]]
112framework = "MITRE ATT&CK"
113
114[[rule.threat.technique]]
115id = "T1059"
116name = "Command and Scripting Interpreter"
117reference = "https://attack.mitre.org/techniques/T1059/"
118
119[[rule.threat.technique.subtechnique]]
120id = "T1059.001"
121name = "PowerShell"
122reference = "https://attack.mitre.org/techniques/T1059/001/"
123
124[[rule.threat.technique.subtechnique]]
125id = "T1059.003"
126name = "Windows Command Shell"
127reference = "https://attack.mitre.org/techniques/T1059/003/"
128
129[[rule.threat.technique.subtechnique]]
130id = "T1059.007"
131name = "JavaScript"
132reference = "https://attack.mitre.org/techniques/T1059/007/"
133
134[[rule.threat.technique]]
135id = "T1204"
136name = "User Execution"
137reference = "https://attack.mitre.org/techniques/T1204/"
138
139[[rule.threat.technique.subtechnique]]
140id = "T1204.002"
141name = "Malicious File"
142reference = "https://attack.mitre.org/techniques/T1204/002/"
143
144[rule.threat.tactic]
145id = "TA0002"
146name = "Execution"
147reference = "https://attack.mitre.org/tactics/TA0002/"
148
149[[rule.threat]]
150framework = "MITRE ATT&CK"
151
152[[rule.threat.technique]]
153id = "T1105"
154name = "Ingress Tool Transfer"
155reference = "https://attack.mitre.org/techniques/T1105/"
156
157[rule.threat.tactic]
158id = "TA0011"
159name = "Command and Control"
160reference = "https://attack.mitre.org/tactics/TA0011/"
161
162[[rule.threat]]
163framework = "MITRE ATT&CK"
164
165[[rule.threat.technique]]
166id = "T1218"
167name = "System Binary Proxy Execution"
168reference = "https://attack.mitre.org/techniques/T1218/"
169
170[[rule.threat.technique.subtechnique]]
171id = "T1218.005"
172name = "Mshta"
173reference = "https://attack.mitre.org/techniques/T1218/005/"
174
175[[rule.threat.technique.subtechnique]]
176id = "T1218.007"
177name = "Msiexec"
178reference = "https://attack.mitre.org/techniques/T1218/007/"
179
180[[rule.threat.technique.subtechnique]]
181id = "T1218.011"
182name = "Rundll32"
183reference = "https://attack.mitre.org/techniques/T1218/011/"
184
185[rule.threat.tactic]
186id = "TA0005"
187name = "Defense Evasion"
188reference = "https://attack.mitre.org/tactics/TA0005/"