Visual Studio Code Tunnel Service Installation
This rule detects the installation of Visual Studio Code Tunnel (code-tunnel) as a Windows service. Adversaries may use legitimate tools like VS Code Tunnel for command and control (C2) to establish persistent communication channels that blend in with normal network traffic, making detection more difficult. The detection logic specifically looks for command-line arguments indicative of service installation, including 'tunnel', 'service', 'internal-run', and 'tunnel-service.log'.
Sigma
