Windows file creation of code_tunnel.json indicating non-VSCode VS Code tunneling usage

title: Windows file creation of code_tunnel.json indicating non-VSCode VS Code tunneling usage
id: 779a6868-80d5-4410-b345-26ac3f02451b
status: test
description: This rule flags creation of a file named code_tunnel.json on Windows, which can indicate use of the VS Code tunneling utility by an executable other than VS Code. Attackers may drop or rename related artifacts to establish or mask tunneling-based connectivity for command-and-control. The detection relies on file creation events and cross-references the creating Image/Process name via filename suffix checks to exclude common VS Code executables.
references:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_vscode_tunnel_renamed_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
tags:
  - attack.command-and-control
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \code_tunnel.json
  filter_main_legit_name:
    Image|endswith:
      - \code-tunnel.exe
      - \code.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d102b8f5-61dc-4e68-bd83-9a3187c67377
    type: derived