Cross-source coverage

T1176.002 / ATT&CK

Software Extensions: IDE Extensions

3 rules across 1 source.

From MITRE ATT&CK 20.0

Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems. IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions - software components that add features like code linting, auto-completion, task automation, or integration with tools like Git and Docker. A malicious extension can be installed through an extension marketplace (i.e., Compromise Software Dependencies and Development Tools) or side-loaded directly into the IDE.

In addition to installing malicious extensions, adversaries may also leverage benign ones. For example, adversaries may establish persistent SSH tunnels via the use of the VSCode Remote SSH extension (i.e., IDE Tunneling).

Trust is typically established through the installation process; once installed, the malicious extension is run every time that the IDE is launched. The extension can then be used to execute arbitrary code, establish a backdoor, mine cryptocurrency, or exfiltrate data.

Tactics
Persistence
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLNSM:Flowmacos:unifiedlog

How MITRE says to detect it DET0561

Detect malicious IDE extension install/usage and IDE tunneling

Windows Analytic 1548

Adversary installs or side-loads an IDE extension (VS Code, IntelliJ/JetBrains, Eclipse) or enables IDE tunneling. Chain: (1) IDE binary starts on a non-developer endpoint or server, often with install/force/tunnel flags → (2) extension files/registrations appear under user profile → (3) browser/IDE initiates outbound connections to extension marketplaces, update endpoints, or IDE remote/tunnel services → (4) optional child tools (ssh, node, powershell) execute under the IDE context.

  • WinEventLog:Security EventCode=4688
  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Sysmon EventCode=11

Linux Analytic 1549

Adversary installs or abuses IDE extensions via CLI or direct write to profile directories and then communicates with marketplaces or remote tunnel services. Chain: auditd execve (code/idea/eclipse) with install/update flags or writes under ~/.vscode/extensions, ~/.config/JetBrains → outbound flows to *.visualstudio.com, marketplace.visualstudio.com, *.jetbrains.com, githubusercontent.com, or SSH/WebSocket tunnel endpoints → optional ssh/node processes spawned by IDE.

  • auditd:SYSCALL execve
  • auditd:SYSCALL open,creat,rename,write
  • NSM:Flow Connections from IDE hosts to marketplace/tunnel domains

macOS Analytic 1550

Adversary adds IDE extensions or plugins (VS Code, JetBrains Toolbox/EAP, Eclipse) via GUI or CLI, possibly via managed profiles. Chain: process start with install/update flags → plist/extension folder changes under ~/Library/Application Support/Code or ~/Library/Application Support/JetBrains → outbound connections to marketplaces/tunnel services → optional helper (ssh/node) spawned.

  • macos:unifiedlog Execution of Code.app, idea, JetBrainsToolbox, eclipse with install/extension flags
  • macos:unifiedlog Writes under ~/Library/Application Support/Code*/extensions or JetBrains plugins
  • macos:unifiedlog Outbound connections from IDE processes to marketplace/tunnel domains

View on attack.mitre.org ↗

elastic/detection-rules

3 rules
Detection Severity Format
Multiple Credential Access by VS Code or Cursor IDE Descendant High Elastic TOML
Suspicious Command Execution from Visual Studio Code Medium Elastic TOML
Suspicious IDE Extension Installation from VSIX Medium Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.