Detect IDE Extensions in Elastic Security
Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems. IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions — software components that add features like code linting, auto-completion, task automation, or integration with external tools. A malicious extension can be installed through an extension marketplace or side-loaded directly into the IDE via a .vsix package. Once installed, the extension runs every time the IDE is launched, enabling persistent arbitrary code execution, backdoor establishment, cryptocurrency mining, or data exfiltration. Adversaries may also leverage benign extensions: for example, Mustang Panda has abused the VSCode built-in tunnel feature (code.exe tunnel) to establish persistent reverse shells routed through Microsoft infrastructure, bypassing firewall controls.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1176 Software Extensions
- Sub-technique
- T1176.002 IDE Extensions
- Canonical reference
- https://attack.mitre.org/techniques/T1176/002/
Elastic Detection Query
sequence by host.name with maxspan=5m
[
any where (
(process.name in~ ("code.exe", "code-insiders.exe", "code-server", "idea.exe", "idea64.exe", "eclipse.exe", "webstorm.exe", "pycharm.exe", "pycharm64.exe", "phpstorm.exe", "rider.exe", "goland.exe", "clion.exe", "datagrip.exe") and process.args : "tunnel") or
(process.name in~ ("code.exe", "code-insiders.exe") and process.args : "--install-extension" and process.args : "*.vsix") or
(process.parent.name in~ ("code.exe", "code-insiders.exe", "idea.exe", "idea64.exe", "eclipse.exe", "webstorm.exe", "pycharm.exe", "pycharm64.exe", "phpstorm.exe", "rider.exe", "goland.exe", "clion.exe", "datagrip.exe") and
process.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "schtasks.exe", "net.exe", "net1.exe", "whoami.exe", "nltest.exe", "curl.exe", "wget.exe") and
not process.command_line : ("*git *", "*npm *", "*yarn *", "*pip *", "*cargo *", "*dotnet *", "*gradle*", "*mvn *", "*make *", "*cmake*", "*eslint*", "*prettier*", "*tsc *"))
)
] by process.entity_idDetects malicious IDE extension activity via four branches: VSCode tunnel creation (Mustang Panda TTP), VSIX side-loading from local files, IDE processes spawning high-risk child processes without legitimate build patterns, and IDE processes making non-HTTPS external network connections. Covers Visual Studio Code, JetBrains IDEs, and Eclipse.
Data Sources
Required Tables
False Positives & Tuning
- Developers using VSCode Remote Tunnels legitimately for remote development will trigger the tunnel branch — verify tunnel creation matches known developer machines and working hours
- Security researchers or IT staff side-loading custom internal extensions via .vsix packages will trigger the VSIX sideload branch — correlate with change management tickets
- Build systems and CI/CD agents running inside IDEs (e.g. IntelliJ running Gradle tasks that invoke cmd.exe) may trigger the suspicious child process branch — whitelist known build hosts by hostname
Other platforms for T1176.002
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1VSCode Tunnel Creation (Mustang Panda TTP)
Expected signal: Sysmon Event ID 1: Process Create with Image=code.exe, CommandLine containing 'tunnel --accept-server-license-terms --name df00tech-test'. Sysmon Event ID 3: Network connection from code.exe to Microsoft tunnel infrastructure (*.tunnels.api.visualstudio.com or *.vscode.dev) on port 443. File creation events in %USERPROFILE%\.vscode\cli\servers\
- Test 2VSCode Extension Side-Load from Local VSIX
Expected signal: Sysmon Event ID 1: Process Create with Image=code.exe, CommandLine containing '--install-extension' and '.vsix'. Sysmon Event ID 11: File creation in %USERPROFILE%\.vscode\extensions\df00tech.df00tech-test-* directory. Sysmon Event ID 1 for powershell.exe (Compress-Archive) spawned to create the VSIX.
- Test 3IDE Extension Spawning PowerShell Command
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '-NoProfile -WindowStyle Hidden', ParentImage=powershell.exe. If executed from within a VSCode terminal or task, ParentImage will be code.exe or extensionHost process. Security Event ID 4688 (if command line auditing enabled).
- Test 4Enumerate Installed VSCode Extensions for Suspicious Entries
Expected signal: Sysmon Event ID 1: Process Create with Image=code.exe, CommandLine='--list-extensions --show-versions'. Output logged to console listing all installed extensions with version numbers. Sysmon Event ID 1 for any spawned processes (code.exe may spawn helpers).
- Test 5VSCode Extension Directory Modification via External Process
Expected signal: Sysmon Event ID 11: File Create with TargetFilename in %USERPROFILE%\.vscode\extensions\ and Image=cmd.exe (not code.exe or node.exe). Sysmon Event ID 1: Process Create for cmd.exe with CommandLine showing the write operation.
References (8)
- https://attack.mitre.org/techniques/T1176/002/
- https://www.mnemonic.io/resources/blog/misuse-of-visual-studio-code-for-traffic-tunnelling/
- https://thehackernews.com/2023/01/hackers-distributing-malicious-visual.html
- https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/
- https://blog.extensiontotal.com/mining-in-plain-sight-the-vs-code-extension-cryptojacking-campaign-19ca12904b59
- https://unit42.paloaltonetworks.com/chinese-threat-actors-using-vscode/
- https://code.visualstudio.com/docs/remote/tunnels
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1176/T1176.md
Unlock Pro Content
Get the full detection package for T1176.002 including response playbook, investigation guide, and atomic red team tests.