VS Code Spawning Malicious Agents (DPRK jupyter-powerdev)
Detects the execution handoff from a malicious JavaScript extension within VS Code to host-specific execution agents. This includes compiled Windows executables like 'monitor-agent.exe', 'job-agent.exe', 'processor-service.exe', and Python processes executing Linux/macOS agent scripts such as 'handler-agent.py', 'monitor-agent.py', 'processor-agent.py'. The detection logic filters for processes initiated by 'node.exe', 'electron.exe', or 'code.exe'.
Microsoft Sentinel (KQL)
