Windows File Create of code_tunnel.json Indicates VS Code Tunneling Usage

Alerts on Windows file creation of code_tunnel.json, indicating VS Code tunneling may be active.

FreeUnreviewedSigmamediumv1

windows-file-create-of-code-tunnel-json-indicates-vs-code-tunneling-usage-9661ec9d

title: Windows File Create of code_tunnel.json Indicates VS Code Tunneling Usage
id: e8cd6686-7542-4be1-af01-75af7f0000e6
status: test
description: This rule flags file creation events where the target filename ends with "\code_tunnel.json" on Windows. The presence of this specific file indicates VS Code tunneling functionality is being used, which attackers could abuse to establish or support command-and-control connectivity. It relies on file event telemetry that records the target filename for created or written files.
references:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/file/file_event/file_event_win_vscode_tunnel_indicators.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
tags:
  - attack.command-and-control
  - detection.threat-hunting
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \code_tunnel.json
  condition: selection
falsepositives:
  - Legitimate usage of VsCode tunneling functionality will also trigger this
level: medium
license: DRL-1.1
related:
  - id: 9661ec9d-4439-4a7a-abed-d9be4ca43b6d
    type: derived

What it detects

This rule flags file creation events where the target filename ends with "\code_tunnel.json" on Windows. The presence of this specific file indicates VS Code tunneling functionality is being used, which attackers could abuse to establish or support command-and-control connectivity. It relies on file event telemetry that records the target filename for created or written files.

Known false positives

Legitimate usage of VsCode tunneling functionality will also trigger this

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.