Lazarus Contagious Interview - Developer Artifact Theft via Git and VS Code Credential Access
Detects unauthorized access to sensitive developer artifacts, including Git credentials, GitHub CLI configurations, GitHub Desktop logs, and VS Code global storage files by suspicious processes (Node.js, Python, or VS Code executables) commonly leveraged in the 'Contagious Interview' campaign associated with the Lazarus Group for credential theft.
Microsoft Sentinel (KQL)
