Detect IDE Extensions in CrowdStrike LogScale
Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems. IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions — software components that add features like code linting, auto-completion, task automation, or integration with external tools. A malicious extension can be installed through an extension marketplace or side-loaded directly into the IDE via a .vsix package. Once installed, the extension runs every time the IDE is launched, enabling persistent arbitrary code execution, backdoor establishment, cryptocurrency mining, or data exfiltration. Adversaries may also leverage benign extensions: for example, Mustang Panda has abused the VSCode built-in tunnel feature (code.exe tunnel) to establish persistent reverse shells routed through Microsoft infrastructure, bypassing firewall controls.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1176 Software Extensions
- Sub-technique
- T1176.002 IDE Extensions
- Canonical reference
- https://attack.mitre.org/techniques/T1176/002/
LogScale Detection Query
// T1176.002 — IDE Extension Abuse Detection
// Branch 1: VSCode tunnel creation (Mustang Panda reverse shell TTP)
#repo=base_sensor #event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(code\.exe|code-insiders\.exe|code-server)/
| CommandLine = /(?i)\btunnel\b/
| eval DetectionBranch = "VSCode-Tunnel-Reverse-Shell"
| eval RiskScore = 90
// Union Branch 2: VSIX side-load installation
| union [
#repo=base_sensor #event_simpleName=ProcessRollup2
| ImageFileName = /(?i)code.*\.exe/
| CommandLine = /(?i)--install-extension.*\.vsix/
| eval DetectionBranch = "VSIX-Extension-Sideload"
| eval RiskScore = 75
]
// Union Branch 3: IDE spawning suspicious child processes
| union [
#repo=base_sensor #event_simpleName=ProcessRollup2
| ParentBaseFileName = /(?i)(code\.exe|code-insiders\.exe|idea\.exe|idea64\.exe|eclipse\.exe|webstorm\.exe|pycharm\.exe|pycharm64\.exe|phpstorm\.exe|rider\.exe|goland\.exe|clion\.exe|datagrip\.exe)/
| ImageFileName = /(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|schtasks\.exe|whoami\.exe|nltest\.exe|curl\.exe|wget\.exe)/
| CommandLine != /(?i)(git |npm |yarn |pip |cargo |dotnet |gradle|mvn |make |cmake|eslint|prettier|tsc )/
| eval DetectionBranch = "IDE-Suspicious-Child-Process"
| eval RiskScore = 70
]
// Union Branch 4: IDE external non-HTTPS network connection
| union [
#repo=base_sensor #event_simpleName=NetworkConnectIP4
| ImageFileName = /(?i)(code\.exe|code-insiders\.exe|idea\.exe|idea64\.exe|eclipse\.exe|webstorm\.exe|pycharm\.exe|pycharm64\.exe|phpstorm\.exe|rider\.exe|goland\.exe|clion\.exe)/
| RemotePort != 80
| RemotePort != 443
| RemoteAddressIP4 != /^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.)/
| eval DetectionBranch = "IDE-External-NonHTTPS-Connection"
| eval RiskScore = 60
]
// Aggregate and output
| table([timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, RemoteAddressIP4, RemotePort, DetectionBranch, RiskScore])
| sort(timestamp, order=desc)CrowdStrike LogScale CQL query using ProcessRollup2 and NetworkConnectIP4 Falcon sensor events to detect IDE extension abuse across four branches: VSCode tunnel creation, VSIX side-loading, IDE spawning high-risk child processes outside build contexts, and IDE processes connecting to external non-HTTPS endpoints. Risk scores assigned per branch severity.
Data Sources
Required Tables
False Positives & Tuning
- VSCode Remote Tunnels used legitimately — the tunnel branch will fire for every developer using this supported feature; build a suppression groupBy(ComputerName, UserName) with a count threshold or whitelist known tunnel users in a Falcon custom IOA exclusion
- Penetration testers or red team operators using VSCode as a C2 delivery mechanism on their own authorized assessment targets — confirm with change management and scope documents before escalating
- JetBrains IDEs on build servers connecting to artifact repositories (Nexus, Artifactory, private npm registries) on non-standard ports — baseline known build servers and add them to a ComputerName exclusion list for Branch 4
Other platforms for T1176.002
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1VSCode Tunnel Creation (Mustang Panda TTP)
Expected signal: Sysmon Event ID 1: Process Create with Image=code.exe, CommandLine containing 'tunnel --accept-server-license-terms --name df00tech-test'. Sysmon Event ID 3: Network connection from code.exe to Microsoft tunnel infrastructure (*.tunnels.api.visualstudio.com or *.vscode.dev) on port 443. File creation events in %USERPROFILE%\.vscode\cli\servers\
- Test 2VSCode Extension Side-Load from Local VSIX
Expected signal: Sysmon Event ID 1: Process Create with Image=code.exe, CommandLine containing '--install-extension' and '.vsix'. Sysmon Event ID 11: File creation in %USERPROFILE%\.vscode\extensions\df00tech.df00tech-test-* directory. Sysmon Event ID 1 for powershell.exe (Compress-Archive) spawned to create the VSIX.
- Test 3IDE Extension Spawning PowerShell Command
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '-NoProfile -WindowStyle Hidden', ParentImage=powershell.exe. If executed from within a VSCode terminal or task, ParentImage will be code.exe or extensionHost process. Security Event ID 4688 (if command line auditing enabled).
- Test 4Enumerate Installed VSCode Extensions for Suspicious Entries
Expected signal: Sysmon Event ID 1: Process Create with Image=code.exe, CommandLine='--list-extensions --show-versions'. Output logged to console listing all installed extensions with version numbers. Sysmon Event ID 1 for any spawned processes (code.exe may spawn helpers).
- Test 5VSCode Extension Directory Modification via External Process
Expected signal: Sysmon Event ID 11: File Create with TargetFilename in %USERPROFILE%\.vscode\extensions\ and Image=cmd.exe (not code.exe or node.exe). Sysmon Event ID 1: Process Create for cmd.exe with CommandLine showing the write operation.
References (8)
- https://attack.mitre.org/techniques/T1176/002/
- https://www.mnemonic.io/resources/blog/misuse-of-visual-studio-code-for-traffic-tunnelling/
- https://thehackernews.com/2023/01/hackers-distributing-malicious-visual.html
- https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/
- https://blog.extensiontotal.com/mining-in-plain-sight-the-vs-code-extension-cryptojacking-campaign-19ca12904b59
- https://unit42.paloaltonetworks.com/chinese-threat-actors-using-vscode/
- https://code.visualstudio.com/docs/remote/tunnels
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1176/T1176.md
Unlock Pro Content
Get the full detection package for T1176.002 including response playbook, investigation guide, and atomic red team tests.