Windows File Creation by VS Code Tunnel node.exe in .vscode-server History
Alerts on node.exe creating files under .vscode-server User History when the process runs from a VS Code server tunnel path.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-10-25
- Updated
- 2026-07-31
What it detects
This rule identifies file creation events where the process image path points to a VS Code tunnel node.exe under a Stable server directory. It specifically matches target filenames located in the .vscode-server data user history path, which may indicate remote file activity through the VS Code tunnel feature. The detection relies on Windows file event telemetry that includes the creating process image path and the target filename.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-node-exe-creates-files-in-vscode-server-history-via-vs-code-server-tunne-56e05d41
title: Windows File Creation by VS Code Tunnel node.exe in .vscode-server History
id: 1c9f4917-7477-4669-89c1-a981c6cda624
status: test
description: This rule identifies file creation events where the process image path points to a VS Code tunnel node.exe under a Stable server directory. It specifically matches target filenames located in the .vscode-server data user history path, which may indicate remote file activity through the VS Code tunnel feature. The detection relies on Windows file event telemetry that includes the creating process image path and the target filename.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_vscode_tunnel_remote_creation_artefacts.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
tags:
- attack.command-and-control
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains: \servers\Stable-
Image|endswith: \server\node.exe
TargetFilename|contains: \.vscode-server\data\User\History\
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 56e05d41-ce99-4ecd-912d-93f019ee0b71
type: derived