Windows: node.exe Creates Files in .vscode-server History via VS Code Server Tunnel Path

title: "Windows: node.exe Creates Files in .vscode-server History via VS Code Server Tunnel Path"
id: 1c9f4917-7477-4669-89c1-a981c6cda624
status: test
description: This rule flags file creation events where node.exe runs from a VS Code server tunnel path and writes into the .vscode-server data User History directory. Attackers can use such file activity to stage or persist content through the VS Code tunnel workflow. The detection relies on Windows file event telemetry, matching the process image path pattern and the target filename path segment associated with .vscode-server history writes.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_vscode_tunnel_remote_creation_artefacts.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
tags:
  - attack.command-and-control
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|contains: \servers\Stable-
    Image|endswith: \server\node.exe
    TargetFilename|contains: \.vscode-server\data\User\History\
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 56e05d41-ce99-4ecd-912d-93f019ee0b71
    type: derived