Defending the Dev Environment: Analyzing VS Code's 2-Hour Extension Update Delay

---
title: VS Code Persistence via Startup Folder Modification
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects VS Code main process creating files in Windows Startup folders, a common persistence mechanism used by malicious extensions.
references:
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: file_create
  product: windows
detection:
  selection:
    Image|endswith:
      - '\Code.exe'
      - '\Code - Insiders.exe'
    TargetFilename|contains:
      - '\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\'
      - '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\'
  condition: selection
falsepositives:
  - Legitimate developer tools installing auto-start utilities (rare)
level: high
---
title: VS Code Spawning Obfuscated PowerShell
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects VS Code or its extension host spawning PowerShell with encoded commands, indicative of malicious extension activity.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Code.exe'
      - '\Code - Insiders.exe'
      - '\node.exe' # Extension host often runs as node
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'FromBase64String'
  condition: all of selection_*
falsepositives:
  - Developers debugging scripts that use encoding (rare in auto-spawn context)
level: high

DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("Code.exe", "Code - Insiders.exe", "node.exe")
// Filter out common safe Microsoft/Azure/CDN endpoints to reduce noise
| where RemoteUrl !contains "microsoft" 
| where RemoteUrl !contains "azureedge" 
| where RemoteUrl !contains "visualstudio" 
| where RemoteUrl !contains "github" 
| where RemoteUrl !contains "vscode" 
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemotePort, RemoteIP
| order by Timestamp desc

-- Hunt for suspicious child processes spawned by VS Code
SELECT Pid, Name, CommandLine, Exe, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ "Code" 
   AND ( Name =~ "powershell" 
         OR Name =~ "cmd" 
         OR Name =~ "bash" 
         OR Name =~ "sh" 
         OR Name =~ "curl" 
         OR Name =~ "wget" 
       )

# VS Code Extension Audit Script
# Requires 'code' CLI to be in PATH

Write-Host "[+] Initiating VS Code Extension Security Audit..." -ForegroundColor Cyan

# 1. Get List of Installed Extensions
try {
    $extensions = code --list-extensions --show-versions 2>&1
    if ($LASTEXITCODE -ne 0) { throw "code CLI not found or error executing" }
    
    Write-Host "[+] Found installed extensions. Verifying integrity..." -ForegroundColor Green
    
    # In a real environment, you would hash check these or query an API.
    # Here we list them for manual review.
    $extensions | ForEach-Object {
        $extDetails = $_ -split ' '
        $extName = $extDetails[0]
        $extVer = $extDetails[1]
        
        # Logic: Check if extension is recently updated (within the last 24 hours)
        # This requires checking the disk files in ~/.vscode/extensions
        $extPath = "$env:USERPROFILE\.vscode\extensions\$extName-$extVer"
        if (Test-Path $extPath) {
            $lastWrite = (Get-Item $extPath).LastWriteTime
            if ((Get-Date) - $lastWrite -lt [TimeSpan]::FromHours(24)) {
                Write-Host "[!] WARNING: Extension $extName updated recently ($lastWrite). Manual review recommended." -ForegroundColor Yellow
            }
        }
    }
}
catch {
    Write-Host "[-] Error retrieving extensions: $_" -ForegroundColor Red
}

# 2. Check VS Code Version to ensure hardening is present
try {
    $verOutput = code --version
    Write-Host "[+] Current VS Code Version: $verOutput" -ForegroundColor Green
    # Note: Specific version check for the 2-hour delay feature should be added based on vendor release notes.
}
catch {
    Write-Host "[-] Could not determine VS Code version." -ForegroundColor Red
}