Suspicious Visual Studio Code Tunnel Remote File Creation (via file_event)

title: Suspicious Visual Studio Code Tunnel Remote File Creation (via file_event)
id: e2b4ebbd-2c27-5703-9c4a-81805f69b458
status: stable
description: This rule detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature
references:
    - Internal Research
author: Huntrule Team
date: 2026-07-13
tags:
    - attack.command-and-control
    - attack.t1219
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|contains: '\servers\Stable-'
        Image|endswith: '\server\node.exe'
        TargetFilename|contains: '\.vscode-server\data\User\History\'
    condition: selection
falsepositives:
    - Unknown
level: medium