MUSTANG PANDA VSCode Tunnel For C2
Detects the use of Visual Studio Code (VSCode) tunnels for command and control (C2) or persistence. This technique, observed in use by threat actors like MUSTANG PANDA, leverages legitimate VSCode functionality to bypass network defenses.
YARA-L
