Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Visual Studio Code Tunnel Service Installation

Detects the installation of VsCode tunnel (code-tunnel) as a service.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Nasreddine Bencherchali (Nextron Systems)Created Wed Oct 2530bf1789-379d-4fdc-900f-55cd0a90a801windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        CommandLine|contains|all:
            - 'tunnel '
            - 'service'
            - 'internal-run'
            - 'tunnel-service.log'
    condition: selection
False Positives

Legitimate installation of code-tunnel as a service

References
1
Resolving title…
ipfyx.fr
2
Resolving title…
badoption.eu
3
Resolving title…
code.visualstudio.com
MITRE ATT&CK
Rule Metadata
Rule ID
30bf1789-379d-4fdc-900f-55cd0a90a801
Status
test
Level
medium
Type
Detection
Created
Wed Oct 25
Author
Nasreddine Bencherchali (Nextron Systems)
Path
rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml
Raw Tags
attack.command-and-controlattack.t1071.001
View on GitHub