VS Code tasks.json auto-execution shortly after repo clone (fake job-interview lure)
Detects instances where a git repository is cloned, followed by the execution of VS Code, and subsequently the triggering of an automated task (via tasks.json or .vscode directory) by that VS Code instance within a short timeframe. This sequence may indicate an attacker attempting to execute code or automation routines immediately after cloning a malicious or compromised repository.
Microsoft Sentinel (KQL)
