Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
17
1
1
Contributors
9
4
1
1
1
Categories
12
8
7
3
3
Platforms
16
10
10
2
1
Products / Services
11
3
2
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects instances where the Cursor IDE (or associated helper processes) spawns a child process or executes a command involving a specific 'DevOps-Automation/cloudshield' path. This monitors for potential abuse of IDE environments to trigger sensitive automation scripts, possibly indicating malicious use of IDE tooling or unauthorized development activities.
This rule detects the use of the VS Code command line interface to install extensions, specifically by monitoring for the 'workbench.extensions.installExtension' command. This activity can be indicative of automated installation of extensions, which could be used for malicious purposes or persistence if an attacker installs a malicious extension.
Detects the installation of Visual Studio Code extensions via the command line interface using the Code.exe process. Adversaries may abuse VS Code extensions to achieve code execution or persistence by installing malicious .vsix files.
This rule detects the use of the VS Code command line interface to install extensions, specifically by monitoring for the 'workbench.extensions.installExtension' command. This activity can be indicative of automated installation of extensions, which could be used for malicious purposes or persistence if an attacker installs a malicious extension.
This rule detects the use of the VS Code command line interface to install extensions, specifically by monitoring for the 'workbench.extensions.installExtension' command. This activity can be indicative of automated installation of extensions, which could be used for malicious purposes or persistence if an attacker installs a malicious extension.
This rule detects the installation of malicious VS Code extensions by monitoring file system writes within common VS Code and VS Code Server extension directories. It specifically alerts on a predefined list of extension namespaces associated with a known malicious coordinated campaign that impersonated legitimate publishers.
Detects instances where a VS Code or similar IDE process launches suspicious child processes (Python or temporary executables) shortly after an extension installation or modification event, followed by an outbound network connection to a .workers.dev domain. This behavior is indicative of a malicious IDE extension establishing an interactive command and control (C2) channel or exfiltrating data.
Detects instances where a VS Code or similar IDE process launches suspicious child processes (Python or temporary executables) shortly after an extension installation or modification event, followed by an outbound network connection to a .workers.dev domain. This behavior is indicative of a malicious IDE extension establishing an interactive command and control (C2) channel or exfiltrating data.
Detects the installation of Visual Studio Code extensions from sources other than the official Marketplace. This activity is monitored by checking process command line arguments for the --install-extension flag combined with external URLs or local file paths, which may indicate an attempt to install malicious extensions.
Detects the installation of Visual Studio Code extensions from sources other than the official Marketplace. This activity is monitored by checking process command line arguments for the --install-extension flag combined with external URLs or local file paths, which may indicate an attempt to install malicious extensions.
Detects the installation of Visual Studio Code extensions from sources other than the official Marketplace. This activity is monitored by checking process command line arguments for the --install-extension flag combined with external URLs or local file paths, which may indicate an attempt to install malicious extensions.
Looks for various IDE processes making network connections direct to IP. Excludes private IP ranges but might need contextual exclusions too for environment
This rule detects the download of Visual Studio Code (VS Code) or other Integrated Development Environment (IDE) extensions from official marketplaces (marketplace.visualstudio.com or open-vsx.org) when the downloaded file has a .vsix or .crx extension. This could indicate an attempt to install a malicious extension.
This rule detects various indicators associated with the 'Fake Clawdbot VS Code Extension' malware, which is known to install the ScreenConnect Remote Access Trojan (RAT). Detection logic includes suspicious domain names, specific file names downloaded from those domains or Dropbox, known malicious IP addresses, specific SHA256 hashes of malicious files, outbound network connections on port 8041 (excluding common private/reserved IP ranges), ScreenConnect service installations/starts, and suspicious file writes or process executions from temporary directories related to ScreenConnect or 'Code.exe'.
Scan for 18 malicious extensions
KQL Query from file: Check for Entra Legacy TLS Login
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: M365 Copilot Extensions Threat Monitoring
This query was originally published in the threat analytics report, ironSource PUA & unwanted apps impact millions.
IronSource provides software bundling tools for many popular legitimate apps, such as FileZilla. However, some of ironSource's bundling tools are considered PUA, because they exhibit potentially unwanted behavior. One component of these tools, detected by Microsoft as Prifou, silently transmits system information from the user. It also installs an outdated version of Chromium browser with various browser extensions, resets the user's home page, changes their search engine settings, and forces Chromium and itself to launch at startup.
The following query can be used to locate unique command-line strings used by ironSource bundlers to launch Prifou, as well as commands used by Prifou to install Chromium.
IronSource provides software bundling tools for many popular legitimate apps, such as FileZilla. However, some of ironSource's bundling tools are considered PUA, because they exhibit potentially unwanted behavior. One component of these tools, detected by Microsoft as Prifou, silently transmits system information from the user. It also installs an outdated version of Chromium browser with various browser extensions, resets the user's home page, changes their search engine settings, and forces Chromium and itself to launch at startup.
The following query can be used to locate unique command-line strings used by ironSource bundlers to launch Prifou, as well as commands used by Prifou to install Chromium.
