Visual Studio Code Tunnel Shell Execution

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•4•0•43

Detects the execution of a shell (PowerShell, Bash, WSL) via a Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.