VS Code Tunnel Creation
Detects the command line execution of VS Code initiating a remote tunnel. Threat actors like Tropic Trooper use this technique (e.g., via GitHub or Microsoft providers) to establish interactive remote access while blending in with legitimate developer activity.
Sigma
