Code.exe Running from Non-Standard Locations
This rule detects instances of 'Code.exe' (the executable for Visual Studio Code) running from non-standard or suspicious file system locations. It specifically flags processes originating from temporary directories (like \Temp or \AppData\Local\Temp), the ScreenConnect Client directory, or Program Files (x86) which are not typical installation paths for VS Code. The rule aims to identify potential masquerading or execution of malicious code disguised as VS Code.
Microsoft Sentinel (KQL)
