Suspicious VS Code Extension Execution (ClawBot)
This rule detects the execution of suspicious Visual Studio Code extensions, specifically those associated with known malicious extensions like ClawBot. It identifies instances where the VS Code executable initiates a process with command-line arguments containing keywords related to these malicious extensions.
Microsoft Sentinel (KQL)
