Lazarus Contagious Interview: git clone Followed by VS Code Spawning Suspicious Child Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects suspicious network-related activity initiated by common command-line utilities when spawned as child processes of Visual Studio Code (Code.exe). This pattern is often indicative of automated script execution, malware staging, or adversary activity following code repository manipulation, particularly when preceded by a git clone operation within a 15-minute window.