Node Executing VS Code Repo Env Script (.vscode/env-setup.js)
This rule detects when Node.js executes a script named 'env-setup.js' located within a '.vscode' directory. This pattern is often associated with malicious code execution within development projects, particularly when a developer opens and trusts a repository. The rule specifically looks for 'node.exe' as the image and the script path containing either '\.vscode\env-setup.js' or '/.vscode/env-setup.js' in the command line.
Sigma
