VS Code CLI Tunnel Execution

Elgonad .@elgonad

•updated Mar 20, 2026•1•0•36

Detects the execution of VS Code CLI running in tunnel service mode, indicating potential C&C tunneling. Threat actors increasingly abuse VS Code's native tunneling capabilities to establish covert C&C channels that blend with developer traffic.