Techniques › T1176.002 › AN1550
AN1550 Analytic 1550
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversary adds IDE extensions or plugins (VS Code, JetBrains Toolbox/EAP, Eclipse) via GUI or CLI, possibly via managed profiles. Chain: process start with install/update flags → plist/extension folder changes under ~/Library/Application Support/Code or ~/Library/Application Support/JetBrains → outbound connections to marketplaces/tunnel services → optional helper (ssh/node) spawned.</p>
- Detects
- T1176.002 IDE Extensions
- Part of
- DET0561 Detect malicious IDE extension install/usage and IDE tunneling
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | Execution of Code.app, idea, JetBrainsToolbox, eclipse with install/extension flags | DC0032 Process Creation |
| macos:unifiedlog | Writes under ~/Library/Application Support/Code*/extensions or JetBrains plugins | DC0039 File Creation |
| macos:unifiedlog | Outbound connections from IDE processes to marketplace/tunnel domains | DC0078 Network Traffic Flow |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PlistLocations | Per-app preference domains and plugin directories vary by version. |
MDMProfiles | If MDM installs extensions, allowlist those events to avoid FPs. |
TimeWindow | Correlation range between install and first beacon. |