Malicious Jupyter VSIX Extensions
Detects the presence of known malicious VS Code extension files disguised as Jupyter Notebook and markdown tools, which act as a multi-stage backdoor utilized by North Korean threat actors. The rule specifically looks for file creation events of VSIX files with names associated with a known campaign.
Microsoft Sentinel (KQL)
