Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0561 — Detect malicious IDE extension install/usage and IDE tunneling
DET0561

Detect malicious IDE extension install/usage and IDE tunneling

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN1548 Analytic 1548
Windows

Adversary installs or side-loads an IDE extension (VS Code, IntelliJ/JetBrains, Eclipse) or enables IDE tunneling. Chain: (1) IDE binary starts on a non-developer endpoint or server, often with install/force/tunnel flags → (2) extension files/registrations appear under user profile → (3) browser/IDE initiates outbound connections to extension marketplaces, update endpoints, or IDE remote/tunnel services → (4) optional child tools (ssh, node, powershell) execute under the IDE context.

WinEventLog:Security EventCode=4688 WinEventLog:Sysmon EventCode=3, 22 WinEventLog:Sysmon EventCode=11
[IDEList] Executable names/paths (e.g., code.exe, idea64.exe, eclipse.exe, jetbrains-gateway.exe) vary by version and packaging.
[SuspiciousCLI] Flags such as --install-extension, --force, --disable-extensions, --user-data-dir, --uninstall-extension, tunnel/remote flags are tunable.
[ServerZones] List of hosts where IDEs should never run (prod servers, DCs).
[AllowedHosts] Approved extension marketplaces/ide services; use to suppress benign traffic.
[TimeWindow] Correlation horizon (e.g., 15–30m) between process start, file writes, and outbound IDE/tunnel connections.
AN1549 Analytic 1549
Linux

Adversary installs or abuses IDE extensions via CLI or direct write to profile directories and then communicates with marketplaces or remote tunnel services. Chain: auditd execve (code/idea/eclipse) with install/update flags or writes under ~/.vscode/extensions, ~/.config/JetBrains → outbound flows to *.visualstudio.com, marketplace.visualstudio.com, *.jetbrains.com, githubusercontent.com, or SSH/WebSocket tunnel endpoints → optional ssh/node processes spawned by IDE.

auditd:SYSCALL execve auditd:SYSCALL open,creat,rename,write NSM:Flow Connections from IDE hosts to marketplace/tunnel domains
[IDEPaths] Per-distro/profile extension directories differ; tune for Chromium/JetBrains snap/flatpak paths.
[DomainAllowlist] Enterprise-approved repos and proxies to reduce FPs.
[UserRoleScope] Limit to non-developer users or production servers.
[TimeWindow] Join horizon across file, process, and network telemetry.
AN1550 Analytic 1550
macOS

Adversary adds IDE extensions or plugins (VS Code, JetBrains Toolbox/EAP, Eclipse) via GUI or CLI, possibly via managed profiles. Chain: process start with install/update flags → plist/extension folder changes under ~/Library/Application Support/Code or ~/Library/Application Support/JetBrains → outbound connections to marketplaces/tunnel services → optional helper (ssh/node) spawned.

macos:unifiedlog Execution of Code.app, idea, JetBrainsToolbox, eclipse with install/extension flags macos:unifiedlog Writes under ~/Library/Application Support/Code*/extensions or JetBrains plugins macos:unifiedlog Outbound connections from IDE processes to marketplace/tunnel domains
[PlistLocations] Per-app preference domains and plugin directories vary by version.
[MDMProfiles] If MDM installs extensions, allowlist those events to avoid FPs.
[TimeWindow] Correlation range between install and first beacon.

Detected Techniques

1

Details

MITRE ID
DET0561
STIX ID
x-mitre-detection-strategy--434d1a09-6a53-43ae-8f8c-e0eb853c4a25
Analytics
3
Techniques Detected
1
By Tactic
Persistence
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.