Claude Code VS Code extension backdoor — Defender XDR hunting queries (KQL)
KQL detection rule by Kevin Beaumont (GossiTheDog) · GPL-3.0
Microsoft Defender XDR **Advanced Hunting** queries (KQL) for the backdoored **Claude Code for VS Code** extension **2.1.313**, published on a **non-official** extension repository (limited impact) — part of this detection kit.
**Seven queries**, each with its fidelity: the server IP `134.209.82.225` (high); the extension in process command lines (low); extension files under `.cursor` / `.vscode` (low); the exact malicious version 2.1.313 in files, processes and registry (high); VS Code / Cursor spawning `ssh` / `autossh` (medium); the recon commands — `git config --global user.email`, `ifconfig.me`, `api.ipify.org` (medium); and an all-in-one union of the IP, the persistence files (`.smt`, `.smtk`, `sysmon.cmd`, `smt.cmd`, `com.apple.sysmond.plist`, `.stk_*`) and the payload's strings.
**How to use** paste one query at a time in Defender XDR › Hunting › Advanced hunting (tables DeviceNetworkEvents, DeviceProcessEvents, DeviceFileEvents, DeviceRegistryEvents).
**False positives** the low-fidelity queries list every machine with the extension (any version) — a triage list, not alerts.
**Author** Kevin Beaumont (GossiTheDog) — https://github.com/GossiTheDog/ThreatHunting/blob/master/AdvancedHuntingQueries/AnthropicSupplyChainAttack.kql — kept exactly as published.
**License** GPL-3.0 (from its repository) · **TLP:CLEAR** · **PAP:CLEAR**
// Known malicious IP -- high fidelity
DeviceNetworkEvents
| where RemoteIP == "134.209.82.225"
| project Timestamp,
DeviceName,
InitiatingProcessFileName,
InitiatingProcessCommandLine,
LocalIP,
RemoteIP,
RemotePort,
Protocol
| order by Timestamp desc
// Claude Code extension -- low fidelity
DeviceProcessEvents
| where ProcessCommandLine has_any (
"anthropic.claude-code",
"2.1.313"
)
| project Timestamp,
DeviceName,
InitiatingProcessFileName,
ProcessCommandLine
// Any extension usage -- low fidelity
DeviceFileEvents
| where FolderPath has_any (
".cursor",
".vscode"
)
| where FolderPath has "anthropic.claude-code"
| summarize
FirstSeen=min(Timestamp),
LastSeen=max(Timestamp)
by DeviceName, FolderPath
// Specific malicious version -- high fidelity
union isfuzzy=true
(
DeviceFileEvents
| where FolderPath has "anthropic.claude-code-2.1.313"
),
(
DeviceProcessEvents
| where ProcessCommandLine has "2.1.313"
),
(
DeviceRegistryEvents
| where RegistryValueData has "2.1.313"
)
| project Timestamp,
DeviceName,
Type,
ActionType,
FileName,
FolderPath,
ProcessCommandLine,
RegistryValueData
| order by Timestamp desc
// VSCode and Cursor spawning SSH -- medium fidelity
DeviceProcessEvents
| where InitiatingProcessFileName in~ (
"Code.exe",
"Cursor.exe",
"code",
"cursor"
)
| where FileName in~ (
"ssh",
"ssh.exe",
"autossh"
)
| project Timestamp,
DeviceName,
InitiatingProcessFileName,
FileName,
ProcessCommandLine
// Recon activity -- medium fidelity
DeviceProcessEvents
| where ProcessCommandLine contains "git config --global user.email"
or ProcessCommandLine contains "ifconfig.me"
or ProcessCommandLine contains "api.ipify.org"
| project Timestamp,
DeviceName,
FileName,
ProcessCommandLine
// Umbongo -- Is it because I sang the Kia-Ora advert? I remember that. It's too orangey for crows.
union
(
DeviceNetworkEvents
| where RemoteIP == "134.209.82.225"
),
(
DeviceFileEvents
| where FileName in~ (
".smt",
".smtk",
"sysmon.cmd",
"smt.cmd",
"com.apple.sysmond.plist"
)
),
(
DeviceFileEvents
| where FileName startswith ".stk_"
),
(
DeviceProcessEvents
| where ProcessCommandLine has_any (
"svc-telemetry",
"localhost:22",
"ifconfig.me",
"api.ipify.org",
"anthropic.claude-code",
"2.1.313"
)
)
| order by Timestamp desc