VS Code Phishing - Adobe Themed ClickOnce Manifest
Detects the execution of a spoofed Adobe.application ClickOnce deployment manifest, often initiated by web browsers or the explorer process, indicating a potential phishing attempt.
Microsoft Sentinel (KQL)

