This ES|QL rule detects suspicious sideloaded IDE extensions installed via a VSIX file using the --install-extension CLI switch. It triggers when a process start event shows a .vsix path being used with an IDE executable (e.g., code, cursor, codium, Windsurf) and the VSIX resides in staging areas. The rule accounts for cross-platform paths and parent processes that could launch a downloader or installer (Windows: Users\Public, AppData\Local\Temp, or script hosts; macOS/Linux: /tmp, /var/tmp, /private/tmp, /dev/shm, or shared user paths). It flags cases where the editor is not the direct initiator but a script host or installer hosts the install (powershell, pwsh, mshta, wscript, cscript, msiexec, node, bun, python, osascript, etc.). The detection surfaces fields such as host, user, process, and parent process data, enabling follow-up correlation. It maps to MITRE ATT&CK technique T1176 (Software Extensions) with subtechnique T1176.002 (IDE Extensions) under the Persistence tactic. The rule includes investigation guidance, false-positive considerations, and remediation steps. It uses MV_CONTAINS and LIKE matching on command lines to identify the exact VSIX path and staging directory usage, and preserves key identifiers for incident response (process_name, process_command_line, parent_name, parent_command_line). Severity is medium with a risk score around 47, reflecting a notable but contextual persistence/recon activity that should be confirmed against developer or admin expectations. This rule is designed for endpoint data from Elastic Defend and supports cross-platform coverage for Windows, Linux, and macOS.)