Detects Visual Studio Code (Code.exe on Windows or Code Helper on macOS) spawning a shell or downloader when the command line contains encoded commands, a download cradle, or a reverse-shell pattern. Malicious IDE extensions or workspace/scripts abuse the editor process to execute commands. The rule matches start events for VS Code parent processes (Code.exe, Code Helper, Code Helper Plugin, or code) that invoke a shell or downloader (cmd.exe, PowerShell, sh, bash, curl, wget, etc.) and where the command_line contains patterns such as encoded commands, base64, downloadstrings, or shell pipelines (e.g., curl | sh, wget | sh, Invoke-Expression). It excludes common benign references (docker.internal, localhost, 127.0.0.1, aka.ms/vscode-powershell). When matched, it flags persistence/execution via IDE extensions and prompts investigation into the extension, workspace scripts, dropped files, and any outbound connections. MITRE mappings include T1176.002 (IDE Extensions) and T1059 with subtechniques for PowerShell, Windows Command Shell, and Unix Shell. Recommended remediation includes stopping the child process, uninstalling the extension, quarantining payloads, collecting hashes, and rotating credentials if read from user profiles or workspaces. False positives can arise from developer tasks or integrated terminals; verify parent extension host and known extension paths before whitelisting.