Detect IDE Extensions in Google Chronicle

rule ide_extension_abuse_t1176_002 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects malicious IDE extension abuse including VSCode tunnel creation, VSIX side-loading, suspicious IDE child processes, and IDE external non-HTTPS connections. Covers T1176.002."
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1176.002"
    severity = "HIGH"
    priority = "HIGH"
  events:
    (
      // Branch 1: VSCode tunnel reverse shell (Mustang Panda)
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        AND re.regex($e.principal.process.file.full_path, `(?i)(code\.exe|code-insiders\.exe|code-server)`)
        AND re.regex($e.target.process.command_line, `(?i)\btunnel\b`)
      )
      OR
      // Branch 2: VSIX extension side-load
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        AND re.regex($e.principal.process.file.full_path, `(?i)code.*\.exe`)
        AND re.regex($e.target.process.command_line, `(?i)--install-extension.*\.vsix`)
      )
      OR
      // Branch 3: IDE spawning suspicious child processes
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        AND re.regex($e.principal.process.file.full_path, `(?i)(code\.exe|code-insiders\.exe|idea\.exe|idea64\.exe|eclipse\.exe|webstorm\.exe|pycharm\.exe|pycharm64\.exe|phpstorm\.exe|rider\.exe|goland\.exe|clion\.exe|datagrip\.exe)`)
        AND re.regex($e.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|schtasks\.exe|whoami\.exe|nltest\.exe|curl\.exe|wget\.exe)`)
        AND NOT re.regex($e.target.process.command_line, `(?i)(git |npm |yarn |pip |cargo |dotnet |gradle|mvn |make |cmake|eslint|prettier|tsc )`)
      )
      OR
      // Branch 4: IDE making external non-HTTPS network connection
      (
        $e.metadata.event_type = "NETWORK_CONNECTION"
        AND re.regex($e.principal.process.file.full_path, `(?i)(code\.exe|code-insiders\.exe|idea\.exe|idea64\.exe|eclipse\.exe|webstorm\.exe|pycharm\.exe|pycharm64\.exe)`)
        AND NOT re.regex($e.target.ip, `^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.)`)
        AND $e.target.port != 80
        AND $e.target.port != 443
        AND $e.target.ip != ""
      )
    )
  condition:
    $e
}