Renamed Visual Studio Code Tunnel Execution
This rule detects the execution of Visual Studio Code (VS Code) tunnel functionality, particularly when the executable has been renamed. Attackers can abuse this feature to establish a command and control (C2) channel, bypassing typical network restrictions. The rule looks for command-line arguments indicative of VS Code tunnel activation, including specific arguments for accepting license terms or running as a service, and also checks for `cmd.exe` spawning the tunnel process.
Sigma
