dns_query_win_vscode_tunnel_communication

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•0•21

Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.