IDE extension side-loaded from a local package file

Siemphony@siemphonymediumT1176.002unverified

Detects an editor extension being installed from a package file on disk rather than pulled by identifier from the marketplace — the side-load path MITRE calls out as the alternative to a marketplace compromise, and the point at which the extension gains persistence by running on every launch of the editor. Both conditions sit on the command line rather than on Image, deliberately: the Windows `code` entry point is a batch wrapper that re-execs the editor binary with its CLI bundle, so the process actually recorded varies with packaging, build channel and fork, while the flag and the package extension survive all of them and also catch a provisioning script that shells the install out. Bare marketplace installs are not selected — that is ordinary developer activity — so an extension installed by identifier is an accepted gap. The flags come from MITRE's SuspiciousCLI knob; the pairing chosen here is authored. The brief's log source is Security 4688, which needs *Audit Process Creation* and, critically, the separate *Include command line in process creation events* policy: without the second the CommandLine field is empty and this rule can never fire. Sysmon EventID 1 supplies both. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0561, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "--install-extension" and ProcessCommandLine contains ".vsix")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*--install-extension*" AND CommandLine="*.vsix*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*--install-extension*" AND TO_LOWER(process.command_line) LIKE "*.vsix*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)--install-extension</field>    <field name="CommandLine" type="pcre2">(?i)\.vsix</field>    <description>IDE extension side-loaded from a local package file</description>    <mitre>      <id>T1176.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: browser_credential_theft
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: d3565081-efc7-4206-a714-8ebbacf826c4

ATT&CKT1176.002

T1176.002IDE Extensions

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonbrowser credential theft

browser credential theftAI draft — unreviewed

01 · What this rule detects

A command line that contains both --install-extension and .vsix — an editor extension being installed from a package file on disk rather than pulled by identifier from the marketplace. That is the supported way to side-load. It is not the only way, and it is not the persistence — the rest of this lesson turns on that distinction.

02 · Telemetry you need

Process creation with arguments. The brief's log source is Security 4688,
Nothing else. The rule does not touch Image, parents, users or files.

03 · How the logic works

Why both predicates sit on `CommandLine` and not on `Image`. On Windows, code is a batch wrapper that re-execs the editor with its CLI bundle, so the process name varies with packaging, build channel and fork — a classic dead Image selector waiting to happen. The arguments survive all of it, because the wrapper passes them through. A side effect the reviewer called out: every VS Code fork sharing the CLI surface (code-insiders, code-server, cursor, windsurf, codium) is covered for free. Why the marketplace install is excluded. code --install-extension ms-python.python is ordinary developer activity. Requiring .vsix keeps only the from-disk case. That gap is deliberate and the description says so. The gap that is not acknowledged, and the lesson here. MITRE's AN1548 spells out a four-step chain, and step (2) is "extension files/registrations appear under user profile." A VS Code extension loads from %USERPROFILE%\.vscode\extensions\<publisher>.<name>-<version>\ on every editor launch. Copy an unpacked folder there — or point --extensions-dir at a staged copy — and you get byte-identical persistence with no --install-extension and, in the folder-copy case, no command line at all. The brief supplies a file_event / Sysmon EID 11 log source for exactly that leg, and this rule does not use it. It watches the front door while the persistence walks in through the extensions folder. Always ask which step of an analytic's chain a rule sits on, and whether that step is required for the outcome. Here it is not. And the title oversells the scope. .vsix is a VS Code container. AN1548 names VS Code, IntelliJ/JetBrains and Eclipse, and its IDEList knob names idea64.exe, eclipse.exe and jetbrains-gateway.exe. A JetBrains plugin dropped into %APPDATA%\JetBrains\<ide>\plugins, or an Eclipse dropin, gets zero coverage from a rule titled "IDE extension".

04 · Common false positives

CI and build agents. The reviewer's missed false positive, and the loudest
Extension developers. Package a project, install the result locally —
Air-gapped or proxy-restricted estates where approved extensions are
Golden-image and devcontainer scripts, in bursts on freshly built machines.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0561 and never executed against a log line. The reviewer argued level: medium is too high given the rule's own false positives: on a developer fleet or behind a blocked marketplace this fires continuously and gets muted inside a week. low until the ServerZones scoping exists is the honest reading.
tier_2: scope to hosts where an IDE should never run, then measure. Tier 3 restores MITRE's chain — process start, profile-directory write, and outbound marketplace or tunnel connection joined inside a TimeWindow, which is correlation Sigma cannot express.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

`ServerZones` (MITRE's knob) is where nearly all the value is. The same
`SuspiciousCLI` (MITRE's knob) names --install-extension among others;
Add the file_event companion on `TargetFilename|contains:

Declared by the author

Air-gapped or proxy-restricted environments that distribute approved extensions as package files from an internal share, because the marketplace is unreachable. The command line is identical to a side-loaded backdoor and only the source path tells them apart.
Extension developers installing their own build. Packaging a project and installing the result locally is the normal inner loop for anyone writing an extension, so developer workstations will generate this repeatedly.
Golden image, provisioning and devcontainer build scripts that pre-install pinned extension versions from packaged files, which fire in bursts on freshly built machines and can be scoped out by host rather than by command line.
MITRE's ServerZones knob is the tuning with the most leverage here — the same event is unremarkable on a developer laptop and alarming on a production server or domain controller, and this rule alone cannot tell the two apart.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1176.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/d3565081-efc7-4206-a714-8ebbacf826c4

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

IDE extension side-loaded from a local package file

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it