Automated/Scripted VS Code Extension Installs via Devcontainer or CI Provisioning (Extension Confusion)
Detects automated or scripted installation of VS Code extensions triggered via devcontainer.json provisioning or scripted parent processes (bash, sh, cmd.exe, powershell.exe, pwsh.exe, node.exe, python.exe, python3), flagging hosts with three or more install-extension invocations within a 5-minute window. This pattern is consistent with extension confusion / evil-twin extension campaigns abusing automated provisioning pipelines.
Cortex XDR
