All Detections

Suspicious VS Code Process Spawning Shell

avatar
S@1@N .@kohtet
updated Nov 11, 202519021,663

Detects when Visual Studio Code or its extension host spawns PowerShell, CMD, or similar interpreters (possible SleepyDuck payload execution).

Sigma