Contagious Interview: VS Code Auto-Task Spawning Suspicious Child Process
Detects Visual Studio Code or similar IDE processes launching command-line interpreters (e.g., cmd, powershell, node, python) with suspicious command-line arguments indicative of file downloads, script execution, or network reconnaissance. This rule is designed to identify potential malicious extensions or compromised development environments.
SentinelOne
