Suspicious Child Process from VsCode
Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles. The rule specifically looks for child processes with suspicious image names (e.g., calc.exe, regsvr32.exe, rundll32.exe, cscript.exe, wscript.exe), PowerShell or command prompt processes executing suspicious commands (e.g., Invoke-Expressions, IEX, Invoke-Command, DownloadString, rundll32, regsvr32, wscript, cscript), or child processes launched from suspicious paths (e.g., C:\Users\Public\, C:\Windows\Temp\, C:\Temp\).
Sigma
