T1176.002 — IDE Extensions

Tactic: Persistence · Platforms: Linux, macOS, Windows

Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems. IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions - software components that add features like code linting, auto-completion, task automation,…

Sub-technique of Software Extensions (T1176).

Sigma detection rules (3)

title: "T1176.002 Software Extensions: IDE Extensions"
id: 9ad5c873-eaf2-42a6-8243-3f6e91d76978
description: 'Detects command-line installation or removal of Visual Studio Code / Visual Studio extensions via --install-extension/--uninstall-extension flags, the primary Windows-observable proxy for delivery of a malicious IDE extension; side-loaded extensions that bypass the CLI are not reliably observable via Sysmon process telemetry alone. Tune using: IDEList, SuspiciousCLI, ServerZones, AllowedHosts, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1176/002
author: Shahrukh Khan
date: 2026-03-18
license: MIT
tags:
  - attack.persistence
  - attack.t1176.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\Code.exe'
      - '\Code - Insiders.exe'
      - '\devenv.exe'
    CommandLine|contains:
      - '--install-extension'
      - '--uninstall-extension'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate developer installation of trusted extensions via the command line; verify the extension publisher/ID against an allowlist.

level: medium

title: "T1176.002 Software Extensions: IDE Extensions"
id: cf0a29c3-cbb7-4195-89ab-e67458159063
description: 'Detect malicious IDE extension install/usage, VS Code Remote-SSH tunnel establishment (IDE Tunneling), and equivalent plugin-install CLI invocations for IntelliJ and Eclipse. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: IDEPaths, DomainAllowlist, UserRoleScope, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1176/002
author: Shahrukh Khan
date: 2026-03-28
license: MIT
tags:
  - attack.persistence
  - attack.t1176.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_vscode_install:
    type: EXECVE
    a0|endswith: '/code'
    a1: '--install-extension'
  selection_vscode_tunnel:
    type: EXECVE
    a0|endswith: '/code'
    a1: 'tunnel'
  selection_intellij_install:
    type: EXECVE
    a0|endswith:
      - '/idea.sh'
      - '/idea'
    a1|contains: 'installPlugins'
  selection_eclipse_install:
    type: EXECVE
    a0|endswith: '/eclipse'
    a1: '-application'
    a2: 'org.eclipse.equinox.p2.director'

  condition: 1 of selection_*

falsepositives:
  - Developers legitimately install VS Code/IntelliJ/Eclipse extensions and use VS Code Remote-SSH tunnels for remote development constantly; scope to extension IDs outside an approved allow-list, non-developer user roles, and unexpected tunnel establishment outside change windows.

level: low

title: "T1176.002 Software Extensions: IDE Extensions"
id: 7107326b-899e-4c8d-a863-20fa6bb6a6dd
description: 'Detect malicious IDE extension install/usage and IDE tunneling. (Retargeted to the file_event macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PlistLocations, MDMProfiles, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1176/002
author: Shahrukh Khan
date: 2026-03-10
license: MIT
tags:
  - attack.persistence
  - attack.t1176.002

logsource:
  category: file_event
  product: macos

detection:
  selection:
    TargetFilename|contains: '/Library/Managed Preferences/'
    TargetFilename|endswith: '.mobileconfig'

  condition: selection

falsepositives:
  - Legitimate MDM-pushed configuration profiles for approved extensions create identical file artifacts.

level: medium

Related sub-techniques

• T1176.001 Browser Extensions

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1176.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan