Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1176.002

IDE Extensions

Persistence 3 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Multiple Credential Access by VS Code or Cursor IDE Descendant production 2026-10-26
elastic Suspicious Command Execution from Visual Studio Code production 2026-10-26
elastic Suspicious IDE Extension Installation from VSIX production 2026-10-26