Suspicious VS Code Child Process

Detects unusual or suspicious child processes spawned by Visual Studio Code, which could indicate Remote Code Execution (RCE) stemming from a malicious Jupyter notebook on the desktop client.

Microsoft Sentinel (KQL)