IDE extension side-loaded from a local package file

1title: IDE extension side-loaded from a local package file2id: d3565081-efc7-4206-a714-8ebbacf826c43status: experimental4description: |5  Detects an editor extension being installed from a package file on disk rather6  than pulled by identifier from the marketplace — the side-load path MITRE calls7  out as the alternative to a marketplace compromise, and the point at which the8  extension gains persistence by running on every launch of the editor. Both9  conditions sit on the command line rather than on Image, deliberately: the10  Windows `code` entry point is a batch wrapper that re-execs the editor binary11  with its CLI bundle, so the process actually recorded varies with packaging,12  build channel and fork, while the flag and the package extension survive all of13  them and also catch a provisioning script that shells the install out. Bare14  marketplace installs are not selected — that is ordinary developer activity —15  so an extension installed by identifier is an accepted gap. The flags come from16  MITRE's SuspiciousCLI knob; the pairing chosen here is authored. The brief's log17  source is Security 4688, which needs *Audit Process Creation* and, critically,18  the separate *Include command line in process creation events* policy: without19  the second the CommandLine field is empty and this rule can never fire. Sysmon20  EventID 1 supplies both.21  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0561, not hand-written and not tested by its author. Any lab result is on this rule's own page.22references:23  - https://attack.mitre.org/techniques/T1176/00224  - https://attack.mitre.org/detectionstrategies/DET056125author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)26date: 2026-08-1627tags:28  - attack.persistence29  - attack.t1176.00230logsource:31  category: process_creation32  product: windows33detection:34  selection_install_flag:35    CommandLine|contains: '--install-extension'36  selection_local_package:37    CommandLine|contains: '.vsix'38  condition: selection_install_flag and selection_local_package39falsepositives:40  - "Air-gapped or proxy-restricted environments that distribute approved extensions as package files from an internal share, because the marketplace is unreachable. The command line is identical to a side-loaded backdoor and only the source path tells them apart."41  - "Extension developers installing their own build. Packaging a project and installing the result locally is the normal inner loop for anyone writing an extension, so developer workstations will generate this repeatedly."42  - "Golden image, provisioning and devcontainer build scripts that pre-install pinned extension versions from packaged files, which fire in bursts on freshly built machines and can be scoped out by host rather than by command line."43  - "MITRE's ServerZones knob is the tuning with the most leverage here — the same event is unremarkable on a developer laptop and alarming on a production server or domain controller, and this rule alone cannot tell the two apart."44level: medium