VS Code Server Named Pipe Creation via CMD

Jorden Smith@Jorden

•updated Jan 8, 2026•1•1•37

Detects cmd.exe executing VS Code server components with named pipe usage, indicating VS Code remote server or tunnel activity that may be used for legitimate development or malicious C2 channels