Techniques › T1176 › T1176.002
T1176.002 IDE Extensions
persistence — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1176.002
0
KEV CVEs mapped here
<p>Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems. IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions - software components that add features like code linting, auto-completion, task automation, or integration with tools like Git and Docker. A malicious extension can be installed through an extension marketplace (i.e., Compromise Software Dependencies and Development Tools) or side-loaded directly into the IDE.</p><p>In addition to installing malicious extensions, adversaries may also leverage benign ones. For example, adversaries may establish persistent SSH tunnels via the use of the VSCode Remote SSH extension (i.e., IDE Tunneling).</p><p>Trust is typically established through the installation process; once installed, the malicious extension is run every time that the IDE is launched. The extension can then be used to execute arbitrary code, establish a backdoor, mine cryptocurrency, or exfiltrate data.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0561 Detect malicious IDE extension install/usage and IDE tunneling v1.0
AN1548 WindowsAdversary installs or side-loads an IDE extension (VS Code, IntelliJ/JetBrains, Eclipse) or enables IDE tunneling. Chain: (1) IDE binary starts on a non-developer endpoint or server, often with install/force/tunnel flags → (2) extension files/registrations appear under user profile → (3) browser/IDE initiates outbound connections to extension marketplaces, update endpoints, or IDE remote/tunnel services → (4) optional child tools (ssh, node, powershell) execute under the IDE context.Tunable:
IDEListSuspiciousCLIServerZonesAllowedHostsTimeWindowAN1549 LinuxAdversary installs or abuses IDE extensions via CLI or direct write to profile directories and then communicates with marketplaces or remote tunnel services. Chain: auditd execve (code/idea/eclipse) with install/update flags or writes under ~/.vscode/extensions, ~/.config/JetBrains → outbound flows to .visualstudio.com, marketplace.visualstudio.com, .jetbrains.com, githubusercontent.com, or SSH/WebSocket tunnel endpoints → optional ssh/node processes spawned by IDE.Tunable:IDEPathsDomainAllowlistUserRoleScopeTimeWindowAN1550 macOSAdversary adds IDE extensions or plugins (VS Code, JetBrains Toolbox/EAP, Eclipse) via GUI or CLI, possibly via managed profiles. Chain: process start with install/update flags → plist/extension folder changes under ~/Library/Application Support/Code or ~/Library/Application Support/JetBrains → outbound connections to marketplaces/tunnel services → optional helper (ssh/node) spawned.macos:unifiedlogExecution of Code.app, idea, JetBrainsToolbox, eclipse with install/extension flags→ DC0032 Process Creationmacos:unifiedlogWrites under ~/Library/Application Support/Code*/extensions or JetBrains plugins→ DC0039 File Creationmacos:unifiedlogOutbound connections from IDE processes to marketplace/tunnel domains→ DC0078 Network Traffic FlowTunable:PlistLocationsMDMProfilesTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1176.002
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1176) 1
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: @kostastsale
· 2022-01-10 · logsource: product=windows category=process_creation · 0a74c5a9-1b71-4475-9af2-7829d320d5c2
Detects execution of ChromeLoader malware via a registered scheduled task