Scripted VS Code Extension Install
Detects command-line installation of VS Code extensions (.vsix) launched by script interpreters. Threat actors like UNK_DeadDrop use this technique to silently install malicious extensions via VBScript and CMD payloads.
Microsoft Sentinel (KQL)
