VsCode Powershell Profile Modification

Title: VsCode Powershell Profile Modification
Status: test
Description:Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence
References:
  -https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.2
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-24
modified:2023-01-06
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1546.013'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    TargetFilename|endswith: '\Microsoft.VSCode_profile.ps1'
  condition:selection
Falsepositives:
  -Legitimate use of the profile by developers or administrators
Level: medium