List all the VScode Extensions which are installed on a user system

id: 75830932-794e-4a18-b62f-cc2a010080b5 
name: List all the VScode Extensions which are installed on a user system
description: |
  'Detects observed Visual Studio Code (VS Code) extension installation activity on a user's system within the query time range.
   Note: This query does not return a complete per-user inventory of installed extensions and may miss extensions installed outside the telemetry window or via unsupported installation methods.
   Ref: https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/'
   
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
tactics:
  - Persistence
relevantTechniques:
  - T1547.006
query: |
  DeviceProcessEvents
  | where ProcessCommandLine contains "VSIxs" or ProcessCommandLine contains "vsce-sign.exe"
  | extend ExtensionName = case(
      ProcessCommandLine contains "vsce-sign.exe", extract('CachedExtensionVSIXs\\\\([^\\s"]+)', 1, ProcessCommandLine),
      ProcessCommandLine contains "VSIxs", extract('CachedExtensionVSIXs/([^"]+)', 1, ProcessCommandLine),
    "")
  | extend ExtensionName = iif(isempty(ExtensionName), "", ExtensionName)
  | summarize ExtensionName = make_set(ExtensionName) ,count() by DeviceName, AccountName
entityMappings:
  - entityType: File
    fieldMappings:
      - identifier: Name
        columnName: ExtensionName
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: DeviceName
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
version: 1.0.2
metadata:
    source:
        kind: Community
    author:
        name: Anish Bhowmick
    support:
        tier: Community
    categories:
        domains: [ "Security - Threat Protection" ]