VS Code Extension Spawning ScreenConnect
This rule detects the creation of a process where the parent process is 'node.exe' (associated with Node.js, often used by VS Code extensions) and the child process is either 'ScreenConnect.ClientService.exe' or has 'ScreenConnect' in its command line. This behavior could indicate a VS Code extension spawning a ScreenConnect remote access tool, which might be malicious.
Microsoft Sentinel (KQL)
