Windows DNS queries for Visual Studio Code tunnels domain

Alerts on Windows DNS queries to .tunnels.api.visualstudio.com, matching Visual Studio Code tunnel endpoints.

FreeUnreviewedSigmamediumv1

windows-dns-queries-for-visual-studio-code-tunnels-domain-b3e6418f

title: Windows DNS queries for Visual Studio Code tunnels domain
id: 00de4d85-22e1-4692-bc79-d259fcf97bed
related:
  - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
    type: similar
  - id: 4b657234-038e-4ad5-997c-4be42340bce4
    type: similar
  - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
    type: similar
  - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1
    type: derived
status: test
description: This rule flags DNS queries whose name ends with “.tunnels.api.visualstudio.com”. Such tunnel endpoints can be used to route attacker-controlled traffic or enable remote access, making this a useful indicator for suspicious command-and-control behavior. It relies on Windows DNS query telemetry that includes the queried domain name (QueryName).
references:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://cydefops.com/vscode-data-exfiltration
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml
author: citron_ninja, Huntrule Team
date: 2023-10-25
modified: 2023-11-20
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  product: windows
  category: dns_query
detection:
  selection:
    QueryName|endswith: .tunnels.api.visualstudio.com
  condition: selection
falsepositives:
  - Legitimate use of Visual Studio Code tunnel will also trigger this.
level: medium
license: DRL-1.1

What it detects

This rule flags DNS queries whose name ends with “.tunnels.api.visualstudio.com”. Such tunnel endpoints can be used to route attacker-controlled traffic or enable remote access, making this a useful indicator for suspicious command-and-control behavior. It relies on Windows DNS query telemetry that includes the queried domain name (QueryName).

Known false positives

Legitimate use of Visual Studio Code tunnel will also trigger this.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.