Detect IDE Extensions in Splunk
Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems. IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions — software components that add features like code linting, auto-completion, task automation, or integration with external tools. A malicious extension can be installed through an extension marketplace or side-loaded directly into the IDE via a .vsix package. Once installed, the extension runs every time the IDE is launched, enabling persistent arbitrary code execution, backdoor establishment, cryptocurrency mining, or data exfiltration. Adversaries may also leverage benign extensions: for example, Mustang Panda has abused the VSCode built-in tunnel feature (code.exe tunnel) to establish persistent reverse shells routed through Microsoft infrastructure, bypassing firewall controls.
MITRE ATT&CK
- Tactic
- Persistence
- Technique
- T1176 Software Extensions
- Sub-technique
- T1176.002 IDE Extensions
- Canonical reference
- https://attack.mitre.org/techniques/T1176/002/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval IsIDEProcess=if(match(Image, "(?i)(code\.exe|code-insiders\.exe|idea\.exe|idea64\.exe|eclipse\.exe|webstorm\.exe|pycharm\.exe|pycharm64\.exe|phpstorm\.exe|rider\.exe|goland\.exe|clion\.exe)"), 1, 0)
| eval IsIDEParent=if(match(ParentImage, "(?i)(code\.exe|code-insiders\.exe|idea\.exe|idea64\.exe|eclipse\.exe|webstorm\.exe|pycharm\.exe|pycharm64\.exe|phpstorm\.exe|rider\.exe|goland\.exe|clion\.exe)"), 1, 0)
| eval VscodeTunnel=if(EventCode=1 AND match(Image, "(?i)code.*\.exe") AND match(CommandLine, "(?i)\btunnel\b"), 1, 0)
| eval VSIXSideload=if(EventCode=1 AND match(Image, "(?i)code.*\.exe") AND match(CommandLine, "(?i)--install-extension.*\.vsix"), 1, 0)
| eval SuspiciousIDESpawn=if(EventCode=1 AND IsIDEParent=1 AND match(Image, "(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe|bitsadmin\.exe|schtasks\.exe)") AND NOT match(CommandLine, "(?i)(git |npm |yarn |pip |cargo |dotnet |gradle|mvn |make |cmake|eslint|prettier)"), 1, 0)
| eval IDEExternalConn=if(EventCode=3 AND IsIDEProcess=1 AND NOT match(DestinationIp, "^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.)") AND NOT (DestinationPort=80 OR DestinationPort=443), 1, 0)
| eval SuspicionScore=VscodeTunnel + VSIXSideload + SuspiciousIDESpawn + IDEExternalConn
| where SuspicionScore > 0
| eval DetectionBranch=case(
VscodeTunnel=1, "VSCode-Tunnel-Reverse-Shell",
VSIXSideload=1, "VSIX-Extension-Sideload",
SuspiciousIDESpawn=1, "IDE-Suspicious-Child-Process",
IDEExternalConn=1, "IDE-External-NonHTTPS-Connection",
true(), "Unknown")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, DestinationIp, DestinationPort, DetectionBranch, SuspicionScore
| sort - _timeMulti-branch detection for IDE extension abuse using Sysmon events. Evaluates EventCode=1 (Process Create) for VSCode tunnel creation, .vsix sideloading, and IDE processes spawning suspicious child processes. Also evaluates EventCode=3 (Network Connection) for IDE processes establishing external connections on non-HTTP/HTTPS ports. Assigns a cumulative suspicion score to help analysts prioritize. Coverage matches the KQL detection across four detection branches.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Developers using VSCode Remote Tunnels legitimately for authorized remote development
- Extension developers side-loading their own .vsix files during local testing
- IDE task runners invoking build tools (cmd, powershell) as part of legitimate tasks.json or build configurations
- Cloud IDE extensions (AWS Toolkit, Azure Tools) making management API connections on non-standard ports
- DevContainers feature spawning shell processes as part of container lifecycle management
Other platforms for T1176.002
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1VSCode Tunnel Creation (Mustang Panda TTP)
Expected signal: Sysmon Event ID 1: Process Create with Image=code.exe, CommandLine containing 'tunnel --accept-server-license-terms --name df00tech-test'. Sysmon Event ID 3: Network connection from code.exe to Microsoft tunnel infrastructure (*.tunnels.api.visualstudio.com or *.vscode.dev) on port 443. File creation events in %USERPROFILE%\.vscode\cli\servers\
- Test 2VSCode Extension Side-Load from Local VSIX
Expected signal: Sysmon Event ID 1: Process Create with Image=code.exe, CommandLine containing '--install-extension' and '.vsix'. Sysmon Event ID 11: File creation in %USERPROFILE%\.vscode\extensions\df00tech.df00tech-test-* directory. Sysmon Event ID 1 for powershell.exe (Compress-Archive) spawned to create the VSIX.
- Test 3IDE Extension Spawning PowerShell Command
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '-NoProfile -WindowStyle Hidden', ParentImage=powershell.exe. If executed from within a VSCode terminal or task, ParentImage will be code.exe or extensionHost process. Security Event ID 4688 (if command line auditing enabled).
- Test 4Enumerate Installed VSCode Extensions for Suspicious Entries
Expected signal: Sysmon Event ID 1: Process Create with Image=code.exe, CommandLine='--list-extensions --show-versions'. Output logged to console listing all installed extensions with version numbers. Sysmon Event ID 1 for any spawned processes (code.exe may spawn helpers).
- Test 5VSCode Extension Directory Modification via External Process
Expected signal: Sysmon Event ID 11: File Create with TargetFilename in %USERPROFILE%\.vscode\extensions\ and Image=cmd.exe (not code.exe or node.exe). Sysmon Event ID 1: Process Create for cmd.exe with CommandLine showing the write operation.
References (8)
- https://attack.mitre.org/techniques/T1176/002/
- https://www.mnemonic.io/resources/blog/misuse-of-visual-studio-code-for-traffic-tunnelling/
- https://thehackernews.com/2023/01/hackers-distributing-malicious-visual.html
- https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/
- https://blog.extensiontotal.com/mining-in-plain-sight-the-vs-code-extension-cryptojacking-campaign-19ca12904b59
- https://unit42.paloaltonetworks.com/chinese-threat-actors-using-vscode/
- https://code.visualstudio.com/docs/remote/tunnels
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1176/T1176.md
Unlock Pro Content
Get the full detection package for T1176.002 including response playbook, investigation guide, and atomic red team tests.