VSCode PowerShell Profile Modification
This rule detects the creation or modification of a PowerShell profile specifically for Visual Studio Code (VSCode). Adversaries may modify these profiles to establish persistence or escalate privileges by injecting malicious commands or scripts that execute every time a user opens a VSCode PowerShell session. This technique can be used to run arbitrary code without direct user interaction after the initial compromise.
Sigma
