GLASSWORM.WASM syscall/js shim spawning child processes from VS Code extension host
Detects suspicious child processes spawned by VS Code extension hosts (node.exe, code.exe, code-server, cursor) that indicate potential abuse, possibly related to WASM syscall/js bridge exploitation. The rule specifically looks for common command-line patterns used for downloading and executing payloads, such as those seen in GLASSWORM WASM loader attacks.
Microsoft Sentinel (KQL)
