Windows File Events: VS Code PowerShell Profile Script Creation or Modification

title: "Windows File Events: VS Code PowerShell Profile Script Creation or Modification"
id: 9f069b91-da06-47d2-9317-28ab928e909f
related:
  - id: b5b78988-486d-4a80-b991-930eff3ff8bf
    type: similar
  - id: 3a9fa2ec-30bc-4ebd-b49e-7c9cff225502
    type: derived
status: test
description: This rule flags Windows file activity where a VS Code PowerShell profile script named Microsoft.VSCode_profile.ps1 is created or modified. Attackers may leverage PowerShell profile scripts to persist code that runs in interactive PowerShell sessions launched from VS Code. The detection relies on file event telemetry that records target filenames and changes to files on disk.
references:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_vscode_powershell_profile.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-24
modified: 2023-01-06
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1546.013
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: \Microsoft.VSCode_profile.ps1
  condition: selection
falsepositives:
  - Legitimate use of the profile by developers or administrators
level: medium
license: DRL-1.1