Detectionmediumtest

DNS Query To Visual Studio Code Tunnels Domain

Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
citron_ninjaCreated Wed Oct 25Updated Mon Nov 20b3e6418f-7c7a-4fad-993a-93b65027a9f1windows
Log Source
WindowsDNS Query
ProductWindows← raw: windows
CategoryDNS Query← raw: dns_query

DNS lookup events generated by endpoint monitoring tools.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        QueryName|endswith: '.tunnels.api.visualstudio.com'
    condition: selection
False Positives

Legitimate use of Visual Studio Code tunnel will also trigger this.