Suspicious ClawdBot VS Code Extension Payload Execution
Detects the execution of a process named 'code.exe' or 'lightshot.exe' from a temporary directory. This behavior was observed in a campaign involving a malicious VS Code extension, "ClawdBot Agent", which impersonates a legitimate AI coding assistant. The extension drops and executes a weaponized ScreenConnect payload, masquerading it as a legitimate VS Code or Lightshot process to evade detection. The execution is often spawned by the legitimate VS Code process.
Sigma
