Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
1
1
Categories
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
CVEs
71
71
64
58
49
The query is designed to look for VSC extension use in the environment and determine who and which device the extension is being run on.
The query was built in support of detection for VSC extension abuse
The data from this query can be supported with inventorying of VSC through Microsoft SCCM
The query was built in support of detection for VSC extension abuse
The data from this query can be supported with inventorying of VSC through Microsoft SCCM
Detects when a Visual Studio Code process (Code.exe) or its underlying Node.js process accesses sensitive user directories or files. This could indicate the exploitation of a vulnerable extension, such as in CVE-2025-65717, to steal credentials or other sensitive data.
