Suspicious IDE Hook Persistence via VS Code/Claude Settings
Detects the creation or modification of VS Code tasks or Claude Code settings referencing suspicious setup scripts, indicating persistence mechanisms used by the Mini Shai-Hulud worm. This rule specifically looks for modifications to configuration files like `.vscode/tasks.json` or `.claude/settings.json` by processes with command lines containing known malicious script names, or the direct dropping of these malicious scripts into IDE directories.
Microsoft Sentinel (KQL)
