VS Code Phishing - Tunnel Service Installation (T1543.003)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•6

Detects the execution of 'code.exe' with 'tunnel service install' command-line arguments, initiated by 'WINWORD.EXE'. This activity indicates an attempt to install a persistent tunnel service, potentially as part of a phishing attack chain.