Renamed VsCode Code Tunnel Execution - File Indicator

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•0•0

Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.