{"id":"30bf1789-379d-4fdc-900f-55cd0a90a801","title":"Visual Studio Code Tunnel Service Installation","description":"Detects the installation of VsCode tunnel (code-tunnel) as a service.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-10-25","modified":"","tags":["attack.command-and-control","attack.t1071.001"],"technique_ids":["T1071.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate installation of code-tunnel as a service"],"references":["https://ipfyx.fr/post/visual-studio-code-tunnel/","https://badoption.eu/blog/2023/01/31/code_c2.html","https://code.visualstudio.com/docs/remote/tunnels"],"source_path":"rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml","source_sha256":"eff4cb0340f4f985b4d9c482a02161d6823387a0ed584df9b4d2df11f344a9ed","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Visual Studio Code Tunnel Service Installation\nid: 30bf1789-379d-4fdc-900f-55cd0a90a801\nstatus: test\ndescription: Detects the installation of VsCode tunnel (code-tunnel) as a service.\nreferences:\n    - https://ipfyx.fr/post/visual-studio-code-tunnel/\n    - https://badoption.eu/blog/2023/01/31/code_c2.html\n    - https://code.visualstudio.com/docs/remote/tunnels\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-10-25\ntags:\n    - attack.command-and-control\n    - attack.t1071.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - 'tunnel '\n            - 'service'\n            - 'internal-run'\n            - 'tunnel-service.log'\n    condition: selection\nfalsepositives:\n    - Legitimate installation of code-tunnel as a service\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1071.001","id":"T1071.001","name":"Web Protocols","page":"techniques/enterprise/T1071.001/"}],"data_path":"data/detection-rules/30bf1789-379d-4fdc-900f-55cd0a90a801.json","kind":"sigma"}