GlassWorm-Linked VS Code & Open VSX Color Theme Cluster

Looks for: A VS Code-family editor (Code, Cursor, Windsurf, VSCodium) as the parent of cmd.exe where the command line references temp_batch.cmd, the exact drop-and-run behavior reported for the Aurora Nocturne Night Theme downloader.

// HUNT: Editor spawns cmd.exe running temp_batch.cmd (GlassWorm theme downloader)
// MITRE: T1059.003, T1195.002, T1105
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 on Windows developer endpoints
// FALSE POSITIVES: none expected; a color theme has no legitimate reason to spawn a batch file
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| ParentBaseFileName=/^(code|code - insiders|cursor|windsurf|codium|vscodium)(\.exe)?$/i
| FileName=/^cmd\.exe$/i
| CommandLine=/temp_batch\.cmd/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, TargetProcessId, SHA256HashData])

Looks for: Parent-agnostic execution of temp_batch.cmd through cmd.exe. Catches a variant that re-parents through node.exe or an Electron helper, where the editor is not the direct parent.

// HUNT: cmd.exe executing temp_batch.cmd (parent-agnostic)
// MITRE: T1059.003
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 on Windows
// FALSE POSITIVES: an unrelated internal script that happens to share the filename (verify the parent chain)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| FileName=/^cmd\.exe$/i
| CommandLine=/temp.{0,3}temp_batch\.cmd/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, TargetProcessId])

Looks for: Both halves of hypothesis H2 on one host: the DNS lookup of the payload domain, and a cmd.exe that runs temp_batch.cmd. Correlating them raises confidence well above either signal alone. Why this is not a file-write query: the loader writes the batch file from inside the editor's in-process Node runtime, and a .cmd script is not a PE, ELF, archive or document, so no documented Falcon file-write event (NewExecutableWritten, PeFileWritten, ElfFileWritten, ZipFileWritten, DocumentFileWritten) fires on it. The write itself is recorded as a gap in S15 rather than detected with an event name this pack cannot verify.

// HUNT: payload-host DNS lookup correlated with temp_batch.cmd execution on the same host
// MITRE: T1105, T1059.003, T1071.001
// CONF: high
// FP: low
// COST: medium
// REQUIRES: Falcon sensor on Windows developer hosts (DnsRequest + ProcessRollup2)
// FALSE POSITIVES: near none; requires both the named attacker domain and the named batch filename on one host
// TUNING: selfJoinFilter correlates by host (aid) over the search window, not by exact process tree or ordering; confirm the DNS lookup precedes the cmd.exe start before escalating, and widen the window if the drop and run are minutes apart
#event_simpleName=/^(DnsRequest|ProcessRollup2|SyntheticProcessRollup2)$/
| selfJoinFilter(field=[aid], where=[
    {#event_simpleName=DnsRequest DomainName=/fingercakes4sale\.store$/i},
    {FileName=/^cmd\.exe$/i CommandLine=/temp_batch\.cmd/i}
  ])
| table([@timestamp, aid, ComputerName, UserName, #event_simpleName, DomainName, ParentBaseFileName, FileName, CommandLine])

Looks for: DNS resolution of the one named payload domain, and the process that asked for it. The reported URL path is /dsyuC on that host; DNS telemetry carries only the name.

// HUNT: DNS lookup of fingercakes4sale[.]store (Aurora Nocturne payload host)
// MITRE: T1105, T1071.001
// CONF: high
// FP: low
// COST: low
// REQUIRES: DnsRequest telemetry
// FALSE POSITIVES: security researchers or sandboxes resolving the domain on purpose
#event_simpleName=DnsRequest
| DomainName=/(^|\.)fingercakes4sale\.store$/i
| table([@timestamp, aid, ComputerName, DomainName, ContextBaseFileName, ContextProcessId])

Looks for: Rare child-process pairs under a VS Code-family editor on Windows: cmd, PowerShell, wscript, cscript, mshta, node, curl, certutil, bitsadmin. A theme loader that runs decoded JavaScript and hands off to the shell lands here even when the filename changes. FP: the integrated terminal, Git, task runners and debuggers legitimately spawn shells and node. Review the rare tail, not the head.

// HUNT: Editor process spawns shell, script host or downloader
// MITRE: T1059.003, T1059.007, T1059.001, T1105
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: ProcessRollup2 on Windows developer endpoints
// FALSE POSITIVES: integrated terminal, git, npm/node tasks, debuggers, language servers
// TUNING: baseline 14 days, then exclude the CommandLine values your developers legitimately use (for example CommandLine=/git\.exe|conhost|--ms-enable-electron-run-as-node/i) and sort ascending so rare spawn pairs surface first
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=Win
| ParentBaseFileName=/^(code|code - insiders|cursor|windsurf|codium|vscodium)(\.exe)?$/i
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|mshta|node|curl|certutil|bitsadmin)\.exe$/i
| groupBy([aid, ComputerName, ParentBaseFileName, FileName], function=[count(as=Spawns), max(@timestamp, as=LastSeen), collect([CommandLine])])
| sort(Spawns, order=asc, limit=200)

Looks for: The Cosmic Nebula loader reads a Solana transaction memo to learn its next-stage address. A code editor has no business resolving Solana RPC hosts; the sources advise alerting on developer machines that query the Solana blockchain unexpectedly. FP: developers building web3 or Solana projects will resolve these hosts from their own tooling, usually from node or a terminal, not from the editor process itself.

// HUNT: Editor process DNS lookup for Solana RPC / blockchain hosts
// MITRE: T1102.001
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: DnsRequest with ContextBaseFileName (validate the field in your tenant)
// FALSE POSITIVES: web3 and Solana developers; Solana extensions that call RPC on purpose
// TUNING: exclude hosts in a web3 developer group (aid list or sensor grouping tag) and any approved Solana extension; keep the editor-parent filter so terminal-launched tooling stays out
#event_simpleName=DnsRequest
| DomainName=/solana/i
| ContextBaseFileName=/^(code|code - insiders|cursor|windsurf|codium|vscodium|code helper.*|cursor helper.*)(\.exe)?$/i
| groupBy([aid, ComputerName, ContextBaseFileName, DomainName], function=[count(as=Lookups), max(@timestamp, as=LastSeen)])
| sort(Lookups, order=desc, limit=200)

Looks for: Processes whose image sits under a .vscode, .cursor, .windsurf or .vscode-oss extensions folder. A theme extension has no native executable to run, so any hit from a theme folder is a strong lead; hits from language-tooling extensions are the noise. FP: language servers and debuggers ship native binaries inside extension folders (Go, Rust, C/C++, Python).

// HUNT: Process image launched from an editor extensions directory
// MITRE: T1195.002, T1059
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2; the dot after the profile folder matches the path separator so no slash is needed
// FALSE POSITIVES: language servers, debug adapters, formatter binaries bundled by legitimate extensions
// TUNING: exclude known publisher folders (for example ImageFileName=/ms-python|golang\.go|rust-lang|ms-vscode\.cpptools/i) and keep any hit whose folder name contains "theme"
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\.(vscode|cursor|windsurf|vscode-oss|vscode-insiders).extensions/i
| groupBy([aid, ComputerName, ImageFileName, ParentBaseFileName], function=[count(as=Runs), max(@timestamp, as=LastSeen), collect([CommandLine])])
| sort(Runs, order=asc, limit=200)

Looks for: The reported downloader is Windows-specific, but the loader runs full Node.js in-process on every platform. On macOS and Linux the same pivot is an editor helper process launching sh, bash, zsh, curl, wget or osascript. FP: the integrated terminal is a shell child of an editor helper process by design.

// HUNT: macOS/Linux editor helper spawns shell, curl, wget or osascript
// MITRE: T1059.004, T1059.002, T1105
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: ProcessRollup2 on macOS and Linux sensors
// FALSE POSITIVES: integrated terminal, Git operations, task runners, extension install scripts
// TUNING: exclude interactive terminal launches (CommandLine=/^-?(zsh|bash)( -l)?$/) and sort ascending so one-off curl or osascript spawns surface first
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| event_platform=/^(Mac|Lin)$/
| ParentBaseFileName=/^(code|cursor|windsurf|codium|electron|code helper.*|cursor helper.*)$/i
| FileName=/^(sh|bash|zsh|curl|wget|osascript)$/i
| groupBy([aid, ComputerName, ParentBaseFileName, FileName], function=[count(as=Spawns), max(@timestamp, as=LastSeen), collect([CommandLine])])
| sort(Spawns, order=asc, limit=200)

Looks for: The six Open VSX identities Socket tied to the cluster, seen in a process path or an --install-extension command line. Socket states not every version was weaponized, so a hit means inventory and inspect that package, not auto-confirm. FP: Coca-Cola Christmas and Aurora Borealis Studio were not weaponized in the versions Socket examined; the solidity-syntax.deep-focus name resembles a legitimate Solidity ecosystem name. Confirm version and package contents before escalating.

// HUNT: Cluster-linked extension identities in process paths or install commands
// MITRE: T1195.002
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 (extension host and CLI launches expose the extension folder in the image path or command line)
// FALSE POSITIVES: unweaponized versions of the same identities; similarly named legitimate extensions
// TUNING: confirm the installed version against Socket's weaponized builds; treat a hit as an inventory lead and inspect package.json activationEvents and the main entry point
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/holiday-themes\.theme-coca-cola-christmas|lohsebhipolg2s\.theme-aurora-borealis|aurora-them-creator\.theme-aurora-nocturne|solidity-syntax\.deep-focus|charcoal-mint-studio\.theme-charcoal-mint|cosmic-themes\.theme-cosmic-nebula/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])