Techniques › T1176.002 › AN1548
AN1548 Analytic 1548
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversary installs or side-loads an IDE extension (VS Code, IntelliJ/JetBrains, Eclipse) or enables IDE tunneling. Chain: (1) IDE binary starts on a non-developer endpoint or server, often with install/force/tunnel flags → (2) extension files/registrations appear under user profile → (3) browser/IDE initiates outbound connections to extension marketplaces, update endpoints, or IDE remote/tunnel services → (4) optional child tools (ssh, node, powershell) execute under the IDE context.</p>
- Detects
- T1176.002 IDE Extensions
- Part of
- DET0561 Detect malicious IDE extension install/usage and IDE tunneling
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
IDEList | Executable names/paths (e.g., code.exe, idea64.exe, eclipse.exe, jetbrains-gateway.exe) vary by version and packaging. |
SuspiciousCLI | Flags such as --install-extension, --force, --disable-extensions, --user-data-dir, --uninstall-extension, tunnel/remote flags are tunable. |
ServerZones | List of hosts where IDEs should never run (prod servers, DCs). |
AllowedHosts | Approved extension marketplaces/ide services; use to suppress benign traffic. |
TimeWindow | Correlation horizon (e.g., 15–30m) between process start, file writes, and outbound IDE/tunnel connections. |