Suspicious VSCode Extension Child Process

[rule]
description = """
Detects when a vscode extension spawns an abnormal or suspicious child process. This activity can indicate that a
malicious extension has been installed and is attempting to perform malicious actions on a user's system for initial
access, data stealing, etc.
"""
id = "9718bd56-a611-4c1e-a934-5145d5377656"
license = "Elastic License v2"
name = "Suspicious VSCode Extension Child Process"
os_list = ["macos"]
reference = [
    "https://www.bleepingcomputer.com/news/security/malicious-microsoft-vscode-extensions-steal-passwords-open-remote-shells/",
]
version = "1.0.14"

query = '''
process where event.action == "exec" and 
 (process.parent.executable like~ "/Users/*/.vscode/extensions/*" or process.Ext.effective_parent.executable like~ "/Users/*/.vscode/extensions/*") and
    (
     (process.name in ("sh", "bash", "zsh") and
	     process.args == "-c" and process.args like~ ("*curl*", "*nscurl*", "*osascript*", "*zip*")) or
	  
     (process.name in~ ("tclsh*", "osascript", "curl", "nscurl"))
    ) and not process.parent.code_signature.team_id in ("Q6L2SF6YDW", "2DC432GLL2", "W4NT6CRQ7U")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "8.11.0"