CmdID

CmdID / Files

Code.exe

Visual Studio Code file version info

Program on Windows 4 known copies with hashes 13 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real Code.exe?

file version info and known copies
Original nameelectron.exe in the file’s header: a renamed copy still carries it
Installed inC:\Program Files\Microsoft VS Code\
Signed byMicrosoft Corporation
ProductVisual Studio Code, Microsoft Corporation
DescriptionVisual Studio Code

4 known copies

1.62.0 · C:\Program Files\Microsoft VS Code\Code.exe · signed by Microsoft Corporation

8f7e9404fdec809d51be2b37eebdbbe58148a08594468164f26a46b5f3ce5981

1.49.1 · C:\Program Files\Microsoft VS Code\Code.exe · signed by Microsoft Corporation

65bb2758b1f8b3f4cae9534840a816802ae2b4ca3b2fa4389fb566d1215991ea

1.48.2 · C:\program files\Microsoft VS Code\Code.exe · signed by Microsoft Corporation

295979aaf45cc2db3e5fd139fb3b2f6e967701c3c1d30af0afc9dcf394f931ba

1.48.0 · C:\Program Files\Microsoft VS Code\Code.exe · signed by Microsoft Corporation

a81454b4a0089031e8ff5376a5ccb13bd7fa35bf53a799af0a4dd89c0727a56d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name Code.exe
highRenamed Visual Studio Code Tunnel ExecutionNasreddine Bencherchali (Nextron Systems)
highSuspicious Velociraptor Child ProcessSwachchhanda Shrawan Poudel (Nextron Systems)
mediumPotentially Suspicious Child Process Of VsCodeNasreddine Bencherchali (Nextron Systems)
mediumPotentially Suspicious Electron Application CommandLinefrack113, Nasreddine Bencherchali (Nextron Systems)
mediumPython Inline Command ExecutionNasreddine Bencherchali (Nextron Systems)
lowNon Interactive PowerShell Process SpawnedRoberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)

Sigma names Code.exe in 13 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.