Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1176.002sub-technique of T1176 Software Extensions

IDE Extensions

Linux · macOS · Windowsnothing on this site yetT1176.002 on attack.mitre.org

Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems. IDEs such as Visual Studio Code, IntelliJ IDEA, and Eclipse support extensions - software components that add features like code linting, auto-completion, task automation, or integration with tools like Git and Docker.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

how MITRE says to see it

Detect malicious IDE extension install/usage and IDE tunneling

  • Adversary installs or side-loads an IDE extension (VS Code, IntelliJ/JetBrains, Eclipse) or enables IDE tunneling. Chain: (1) IDE binary starts on a non-developer endpoint or server, often with install/force/tunnel flags → (2) extension files/registrations appear under user profile → (3) browser/IDE initiates outbound...
  • Adversary installs or abuses IDE extensions via CLI or direct write to profile directories and then communicates with marketplaces or remote tunnel services. Chain: auditd execve (code/idea/eclipse) with install/update flags or writes under ~/.vscode/extensions, ~/.config/JetBrains → outbound flows to...
  • Adversary adds IDE extensions or plugins (VS Code, JetBrains Toolbox/EAP, Eclipse) via GUI or CLI, possibly via managed profiles. Chain: process start with install/update flags → plist/extension folder changes under ~/Library/Application Support/Code or ~/Library/Application Support/JetBrains → outbound connections to...

what reduces it

  • M1033 Limit Software Installation. Only install IDE extensions from trusted sources that can be verified.
  • M1017 User Training. Train users to minimize IDE extension use, and to only install trusted extensions.
  • M1038 Execution Prevention. Set an IDE extension allow or deny list as appropriate for your security policy.
  • M1047 Audit. Ensure extensions that are installed are the intended ones, as many malicious extensions may masquerade as legitimate ones.
  • M1051 Update Software. Ensure operating systems and IDEs are using the most current version.

the rest of T1176

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.