Potential VScode Remote Tunnel Established

[rule]
description = """
Detects the rename or modification of the code_tunnel json file which gets created or modified when a remote tunnel
session is created via the VScode portable binary.
"""
id = "aec74eb4-9618-42ff-96eb-2d13e6959d47"
license = "Elastic License v2"
name = "Potential VScode Remote Tunnel Established"
os_list = ["macos", "windows"]
reference = ["https://badoption.eu/blog/2023/01/31/code_c2.html"]
version = "1.0.10"

query = '''
file where event.action != "deletion" and file.name : "code_tunnel.json" and
not process.executable : "C:\\Windows\\explorer.exe"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"
[[threat.technique.subtechnique]]
id = "T1102.002"
name = "Bidirectional Communication"
reference = "https://attack.mitre.org/techniques/T1102/002/"



[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"