DEF CON 34 – Raphael Silva – Claimable VS Code extension ID installed post-publication (supply-chain takeover)
This rule detects the installation of a new VS Code extension occurring in close temporal proximity to network communication with the official VS Code marketplace or unpkg domains. This pattern is designed to surface potential supply chain compromises where malicious extensions may be deployed to developers' machines.
Microsoft Sentinel (KQL)
