Visual Studio Code Tunnel Service Installation

calendar Oct 28, 2023 · attack.command_and_control attack.t1071.001  ·
Share on: linkedin copy

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Sigma rule (View on GitHub)

 1title: Visual Studio Code Tunnel Service Installation
 2id: 30bf1789-379d-4fdc-900f-55cd0a90a801
 3status: experimental
 4description: Detects the installation of VsCode tunnel (code-tunnel) as a service.
 5references:
 6    - https://ipfyx.fr/post/visual-studio-code-tunnel/
 7    - https://badoption.eu/blog/2023/01/31/code_c2.html
 8    - https://code.visualstudio.com/docs/remote/tunnels
 9author: Nasreddine Bencherchali (Nextron Systems)
10date: 2023/10/25
11tags:
12    - attack.command_and_control
13    - attack.t1071.001
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection:
19        CommandLine|contains|all:
20            - 'tunnel '
21            - 'service'
22            - 'internal-run'
23            - 'tunnel-service.log'
24    condition: selection
25falsepositives:
26    - Legitimate installation of code-tunnel as a service
27level: medium

References

  • Blocking Visual Studio Code embedded reverse shell before it's too late

    Visual studio code tunnel Introduction Since July 2023, Microsoft is offering the perfect reverse shell, embedded inside Visual Studio Code, a widely used …


    Read More

  • Let’s Go (VS) Code - Red Team style

    Let’s Go (VS) Code - Red Team style or the Microsoft signed and hosted Reverse Shell TL;DR; MS is offering a signed binary (code.exe), which will establish a Command&Control channel via an official Microsoft domain https://vscode.dev. The C2 communication itself is going to https://global.rel.tunnels.api.visualstudio.com over WebSockets. An attacker only needs an Github account.


    Read More

  • Remote Tunnels

    Using the Visual Studio Code Remote Tunnels extension


    Read More

Related rules

to-top