Visual Studio Code Tunnel Execution

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems), citron_ninja
Source: github.com/SigmaHQ/sigma

Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Known false positives

Legitimate use of Visual Studio Code tunnel

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1071.001` Application Layer Protocol: Web Protocols `T1219` Remote Access Tools

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Visual Studio Code Tunnel Execution
id: 90d6bd71-dffb-4989-8d86-a827fedd6624
status: test
description: Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
references:
    - https://ipfyx.fr/post/visual-studio-code-tunnel/
    - https://badoption.eu/blog/2023/01/31/code_c2.html
    - https://code.visualstudio.com/docs/remote/tunnels
author: Nasreddine Bencherchali (Nextron Systems), citron_ninja
date: 2023-10-25
modified: 2025-10-29
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1219
logsource:
    category: process_creation
    product: windows
detection:
    selection_only_tunnel:
        OriginalFileName: null
        CommandLine|endswith: '.exe tunnel'
    selection_tunnel_args:
        CommandLine|contains|all:
            - '.exe tunnel'
            - '--accept-server-license-terms'
    selection_parent_tunnel:
        ParentCommandLine|endswith: ' tunnel'
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - '/d /c '
            - '\servers\Stable-'
            - 'code-server.cmd'
    condition: 1 of selection_*
falsepositives:
    - Legitimate use of Visual Studio Code tunnel
level: medium

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_only_tunnel`

selection_only_tunnel:
    OriginalFileName: null
    CommandLine|endswith: '.exe tunnel'

Stage 2: `selection_tunnel_args`

selection_tunnel_args:
    CommandLine|contains|all:
        - '.exe tunnel'
        - '--accept-server-license-terms'

Stage 3: `selection_parent_tunnel`

selection_parent_tunnel:
    ParentCommandLine|endswith: ' tunnel'
    Image|endswith: '\cmd.exe'
    CommandLine|contains|all:
        - '/d /c '
        - '\servers\Stable-'
        - 'code-server.cmd'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	ends_with	`.exe tunnel` corpus 2 (sigma 2)	`field:"CommandLine" kind:ends_with value:".exe tunnel"`
`CommandLine`	match	`--accept-server-license-terms` corpus 4 (sigma 3, splunk 1) `.exe tunnel` corpus 2 (sigma 2) `/d /c` corpus 2 (sigma 2) `\servers\Stable-` corpus 2 (sigma 2) `code-server.cmd` corpus 3 (sigma 2, splunk 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\cmd.exe` corpus 130 (sigma 130)	`field:"Image" kind:ends_with value:"\cmd.exe"`
`OriginalFileName`	is_null	(no value, null check)	`field:"OriginalFileName" kind:is_null`
`ParentCommandLine`	ends_with	`tunnel` corpus 2 (sigma 2)	`field:"ParentCommandLine" kind:ends_with value:" tunnel"`

Visual Studio Code Tunnel Execution

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_only_tunnel

Stage 2: selection_tunnel_args

Stage 3: selection_parent_tunnel

Indicators

Stage 0: `condition`

Stage 1: `selection_only_tunnel`

Stage 2: `selection_tunnel_args`

Stage 3: `selection_parent_tunnel`