Possible DNS Query To Visual Studio Code Tunnels Domain (via dns_query)

title: Possible DNS Query To Visual Studio Code Tunnels Domain (via dns_query)
id: 0f08abaf-e9b0-5d27-b1ea-f313468e8989
status: stable
description: This rule detects DNS query requests to Visual Studio Code tunnel domains. Adversaries can misuse that feature to establish a reverse shell or persistence on a machine.
references:
    - https://attack.mitre.org/techniques/T1071/001/
    - https://ipfyx.fr/post/visual-studio-code-tunnel/
    - https://badoption.eu/blog/2023/01/31/code_c2.html
    - https://cydefops.com/vscode-data-exfiltration
author: Huntrule Team
date: 2026-01-13
tags:
    - attack.command-and-control
    - attack.t1071.001
logsource:
    product: windows
    category: dns_query
detection:
    selection:
        QueryName|endswith: '.tunnels.api.visualstudio.com'
    condition: selection
falsepositives:
    - Unknown
level: medium