Visual Studio Code Tunnel Execution
This rule detects the execution of Visual Studio Code's tunnel feature. Attackers can abuse this functionality to establish a command and control (C2) channel, allowing them to remotely control a compromised system. The rule looks for specific command-line arguments associated with the tunnel feature, including '.exe tunnel' and '--accept-server-license-terms'. It also identifies scenarios where 'cmd.exe' is used as a parent process to launch the tunnel, specifically looking for 'code-server.cmd' within the command line.
Sigma
