VS Code GitHub Tunnel Creation
Detects the command line execution of VS Code initiating a tunnel using a GitHub provider. This technique has been observed to be used by threat actors like Tropic Trooper to establish interactive remote access while blending in with legitimate developer activity.
CQL
