VS Code Tunnel Run Key Persistence

Ibrahim Saud@tektrix

•updated Jun 21, 2026•3•0•6

Identifies the addition of the 'Visual Studio Code Tunnel' value under the HKCU Run key, establishing a persistence mechanism. This could indicate an attacker attempting to maintain access to a compromised system by ensuring Visual Studio Code Tunnel starts automatically.