Skip to content

Commit 9f3148f

Browse files
authored
Merge pull request #13566 from Azure/v-kasghosh/issue_number/13288
Updated the Description for VScodeExtensionofanUser Hunting Queries
2 parents f5d4b01 + 6185cd0 commit 9f3148f

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

Hunting Queries/DeviceProcess/VScodeExtensionofanUser.yaml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
id: 75830932-794e-4a18-b62f-cc2a010080b5
22
name: List all the VScode Extensions which are installed on a user system
33
description: |
4-
'Detects potentially malicious Visual Studio Code (VSCode) extensions installed on a users system, which threat actors might use to control devices and exfiltrate personal information.
5-
Ref: https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/'
4+
'Detects observed Visual Studio Code (VS Code) extension installation activity on a user's system within the query time range.
5+
Note: This query does not return a complete per-user inventory of installed extensions and may miss extensions installed outside the telemetry window or via unsupported installation methods.
6+
Ref: https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/'
7+
68
requiredDataConnectors:
79
- connectorId: MicrosoftThreatProtection
810
dataTypes:
@@ -33,7 +35,7 @@ entityMappings:
3335
fieldMappings:
3436
- identifier: Name
3537
columnName: AccountName
36-
version: 1.0.1
38+
version: 1.0.2
3739
metadata:
3840
source:
3941
kind: Community

0 commit comments

Comments
 (0)