Suspicious Command Execution from Visual Studio Code

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Suspicious Command Execution from Visual Studio Code

Detects Visual Studio Code ("Code.exe" on Windows or "Code Helper" on macOS) spawning a shell or downloader whose command line contains an encoded command, a download cradle, or a reverse-shell pattern. Malicious IDE extensions use the editor process to run these commands after install.

Rule type: esql

Rule indices: None

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Endpoint
OS: Windows
OS: macOS
OS: Linux
Use Case: Threat Detection
Tactic: Persistence
Tactic: Execution
Data Source: Elastic Defend
Resources: Investigation Guide
Rule Type: ES|QL
Platform: Windows
Platform: macOS
Platform: Linux

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Suspicious Command Execution from Visual Studio Code

Code.exe or Code Helper started cmd, PowerShell, a Unix shell, curl, or wget, and the command line matches an encoded-command, download, or remote-shell pattern. That is common when a malicious VS Code extension, task, or workspace script runs through the editor.

Possible investigation steps

Review process.command_line for the URL, encoded payload, or shell pipe (curl | sh, wget | sh, Invoke-Expression).
Review process.parent.command_line and process.parent.args for extensionHost or a path under .vscode/extensions or .vscode/tasks.json.
Identify the extension id from that parent path and compare it with the installed extension.
On the same host and user, look for the downloaded file, follow-on processes, and outbound connections.

False positive analysis

Developer tasks and integrated terminals often run curl, wget, echo, or https URLs. echo and https in the pattern match many legitimate commands. Confirm the parent is an extension host or an unexpected workspace task before excluding.
The rule already excludes command lines containing docker.internal, localhost, 127.0.0.1, or aka.ms/vscode-powershell.
Scope exceptions to a known command line, extension path, host, or user. Do not broadly exclude Code.exe or Code Helper.

Response and remediation

If the command is unapproved, stop the child process, uninstall the extension, and remove any dropped file.
Quarantine the payload, collect its hash, and hunt the command line on other hosts.
Rotate tokens or credentials the command could have read from the user profile or workspace.

Setup

edit

Setup

This rule is designed for data generated by Elastic Defend, which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

Rule query

edit

FROM logs-endpoint.events.process-* METADATA _id, _version, _index
| WHERE KQL("""event.category:process and event.type:start""")
  AND process.parent.name IN ("Code Helper (Plugin)", "Code Helper", "Code.exe", "code")
  AND process.name IN (
    "cmd.exe", "powershell.exe", "sh", "bash", "zsh",
    "dash", "nohup", "curl.exe", "curl", "wget",
    "wget.exe", "pwsh.exe"
  )
  AND TO_LOWER(process.command_line) RLIKE """.*(-ec |-enc|-encodedcommand|-nop |-w hidden|https|/dev/tcp|echo|irm |iwr |base64|nohup|http:|iex |invoke-expression|downloadstring|downloadfile|frombase64string|chmod \+|nc -e|ncat|certutil|bitsadmin|invoke-restmethod|curl.*\|.*sh|wget.*\|.*sh).*"""
  AND NOT TO_LOWER(process.command_line) RLIKE """.*(docker.internal|localhost|127.0.0.1|aka.ms/vscode-powershell).*"""
| KEEP
    _id,
    _version,
    _index,
    data_stream.namespace,
    @timestamp,
    host.name,
    host.id,
    agent.id,
    host.os.type,
    user.name,
    user.domain,
    process.name,
    process.parent.name,
    process.parent.executable,
    process.command_line,
    process.executable,
    process.parent.command_line,
    process.parent.args

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Software Extensions
- ID: T1176
- Reference URL: https://attack.mitre.org/techniques/T1176/
Sub-technique:
- Name: IDE Extensions
- ID: T1176.002
- Reference URL: https://attack.mitre.org/techniques/T1176/002/
Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
Technique:
- Name: Command and Scripting Interpreter
- ID: T1059
- Reference URL: https://attack.mitre.org/techniques/T1059/
Sub-technique:
- Name: PowerShell
- ID: T1059.001
- Reference URL: https://attack.mitre.org/techniques/T1059/001/
Sub-technique:
- Name: Windows Command Shell
- ID: T1059.003
- Reference URL: https://attack.mitre.org/techniques/T1059/003/
Sub-technique:
- Name: Unix Shell
- ID: T1059.004
- Reference URL: https://attack.mitre.org/techniques/T1059/004/

« GenAI Agent Instruction File Written to Downloads AWS Bedrock Model Invocation From High Number of Countries »