Visual Studio Code Spawning Web-to-Node Execution
Detects instances where Visual Studio Code spawns a shell process to download a remote script via tools like 'curl' or 'wget' and pipe it directly into the Node.js runtime. This technique has been observed in the "Contagious Interview" campaign, where threat actors abuse VS Code's 'tasks.json' to execute malicious payloads in memory.
Sigma
