Glassworm - Malicious VSCode Extension Spawning Node (T1176)
Detects code.exe launching Node to perform unauthorized background activities, specifically tied to compromised extension folders like quartz-markdown-editor or oorzc.
Microsoft Sentinel (KQL)
