Potential Remote Access Tool Execution via VS Code
Detects the execution of Visual Studio Code (code.exe or code-tunnel) with command-line arguments indicative of remote access, tunneling, or server functionality. This behavior can be legitimate for developers or IT administrators but may also be abused by adversaries for command and control or data exfiltration.
Microsoft Sentinel (KQL)
