Network Connection to Visual Studio Code Tunnels Domain

SigmaHQ Detections@sigmaHQ

•updated Jul 30, 2025•0•20

Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse this feature to establish a reverse shell, persistence, or exfiltrate data from a compromised machine.