GlassWorm Supply Chain: Detecting Malicious Open VSX Extensions

---
title: VS Code Extension Host Spawning System Shell
id: 8f4c3d21-1a5b-4c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects when a VS Code extension host process (typically node.exe) spawns a command shell or PowerShell. This is a common TTP for malicious extensions gaining execution.
references:
  - https://securityaffairs.com/191623/malware/security-affairs-malware-newsletter-round-95.html
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe' # Extension host often runs as node
    ParentCommandLine|contains:
      - 'vscode' # Context of VS Code
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate debugging extensions or developer tools utilizing terminals (rare for extension host to spawn directly).
level: high
---
title: VS Code Extension Process Suspicious Network Connection
id: 9a5f1e22-2b6c-5d9e-0f1a-2b3c4d5e6f7g
status: experimental
description: Detects network connections initiated by VS Code extension host processes to non-standard external endpoints, indicative of C2 beacons or data exfiltration.
references:
  - https://securityaffairs.com/191623/malware/security-affairs-malware-newsletter-round-95.html
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
    InitiatingProcessCommandLine|contains:
      - '.vscode'
  filter_legit:
    DestinationHostname|endswith:
      - '.microsoft.com'
      - '.microsoftonline.com'
      - '.github.com'
      - '.visualstudio.com'
      - '.azureedge.net'
      - '.vscode-unpkg.net'
  condition: selection and not filter_legit
falsepositives:
  - Extensions connecting to known cloud APIs (AWS, Google) that are not in the filter list. Update filters as needed.
level: medium

// Hunt for suspicious child processes spawned by VS Code Extension Host
DeviceProcessEvents
| where InitiatingProcessFileName =~ "node.exe"
| where InitiatingProcessCommandLine has ".vscode"
| where ProcessFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe", "wsl.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FolderPath
| order by Timestamp desc


// Hunt for suspicious network connections from Extension Host
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "node.exe"
| where InitiatingProcessCommandLine has ".vscode"
| where not(RemoteUrl has_any ("microsoft.com", "github.com", "vscode-unpkg.net", "azureedge.net"))
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessCommandLine
| order by Timestamp desc

-- Hunt for installed VS Code extensions
SELECT FullPath,
       Mtime,
       Size
FROM glob(globs='/*/.vscode/extensions/*/package.')
-- In a real investigation, you would parse the JSON to check for 'contributes' or 'scripts'

# Audit VS Code Extensions
Write-Host "[+] Enumerating installed VS Code extensions..." -ForegroundColor Cyan

$UserPath = "$env:USERPROFILE\.vscode\extensions"
$SystemPath = "$env:ProgramFiles\Microsoft VS Code
esources\app\extensions"

if (Test-Path $UserPath) {
    $Extensions = Get-ChildItem -Path $UserPath -Directory
    foreach ($Ext in $Extensions) {
        $Manifest = "$($Ext.FullName)\package."
        if (Test-Path $Manifest) {
            $Data = Get-Content $Manifest | ConvertFrom-Json
            Write-Host "Name: $($Data.displayName) - Publisher: $($Data.publisher.name) - ID: $($Data.name)" -ForegroundColor White
            Write-Host "  Path: $($Ext.FullName)"
            Write-Host "  Version: $($Data.version)"
        }
    }
}

# Remediation: Uninstall extension (Manual Step Placeholder)
# Use the command: code --uninstall-extension <extension-id>
# Example:
# Start-Process "code" -ArgumentList "--uninstall-extension", "publisher.extensionName" -Wait