VS Code Remote Tunnel Used as C2 Channel

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•9

This rule detects HTTP traffic to specific Visual Studio Code (VS Code) remote tunnel domains, specifically 'tunnels.api.visualstudio.com' or 'vscode.dev'. A high frequency of such connections (10 times within 60 seconds from the same source) is flagged as potential command and control (C2) activity, indicating the use of VS Code Remote Tunnels as a C2 channel.