Contagious Interview IDE Tasks Abuse (VS Code and Cursor)
Detects signs that VS Code or Cursor were used to run unwanted commands by monitoring changes to `.vscode\tasks.json` or `.cursor\tasks.json`, and identifying cases where the IDE starts a shell or download tool with suspicious download links or script execution patterns. It also includes a network pivot to link related staging URLs to host activity and possible payload delivery.
Splunk (SPL)
