VSCode Extension Publisher Trust Bypass
Detects the creation or modification of a VSCode package.json file that maps a keybinding to the 'workbench.extensions.installExtension' command while explicitly setting the 'skipPublisherTrust' flag to true. This technique can be used by adversaries to install malicious VSCode extensions without publisher trust checks, potentially leading to supply chain compromise or defense evasion.
Microsoft Sentinel (KQL)
