Windows Process Creation: Visual Studio Code Tunnel (.exe tunnel) Execution
Flags cmd.exe-launched Visual Studio Code tunnel processes with expected tunnel and license-accept arguments on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems), citron_ninja (SigmaHQ), DRL 1.1
- Published
- 2023-10-25
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies process executions where a command line ends with ".exe tunnel" and includes required tunnel license acceptance arguments. It further correlates the parent context to cmd.exe executing code-server.cmd from the Stable servers directory, which is a strong indicator of VS Code tunnel startup. Attackers may abuse this feature to establish an outbound command-and-control path, making this behavior valuable for detecting suspicious tunnel launches. Telemetry relies on Windows process creation fields including Image, ParentCommandLine, and CommandLine.
Reporting behind it
- ipfyx.frhttps://ipfyx.fr/post/visual-studio-code-tunnel/
- badoption.euhttps://badoption.eu/blog/2023/01/31/code_c2.html
- code.visualstudio.comhttps://code.visualstudio.com/docs/remote/tunnels
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Visual Studio Code Tunnel (.exe tunnel) Execution"
id: 78fc9242-008d-43c9-b726-c5b18d07e1ff
status: test
description: This rule identifies process executions where a command line ends with ".exe tunnel" and includes required tunnel license acceptance arguments. It further correlates the parent context to cmd.exe executing code-server.cmd from the Stable servers directory, which is a strong indicator of VS Code tunnel startup. Attackers may abuse this feature to establish an outbound command-and-control path, making this behavior valuable for detecting suspicious tunnel launches. Telemetry relies on Windows process creation fields including Image, ParentCommandLine, and CommandLine.
references:
- https://ipfyx.fr/post/visual-studio-code-tunnel/
- https://badoption.eu/blog/2023/01/31/code_c2.html
- https://code.visualstudio.com/docs/remote/tunnels
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), citron_ninja, Huntrule Team
date: 2023-10-25
modified: 2025-10-29
tags:
- attack.command-and-control
- attack.t1071.001
- attack.t1219
logsource:
category: process_creation
product: windows
detection:
selection_only_tunnel:
OriginalFileName: null
CommandLine|endswith: .exe tunnel
selection_tunnel_args:
CommandLine|contains|all:
- .exe tunnel
- --accept-server-license-terms
selection_parent_tunnel:
ParentCommandLine|endswith: " tunnel"
Image|endswith: \cmd.exe
CommandLine|contains|all:
- "/d /c "
- \servers\Stable-
- code-server.cmd
condition: 1 of selection_*
falsepositives:
- Legitimate use of Visual Studio Code tunnel
level: medium
license: DRL-1.1
related:
- id: 90d6bd71-dffb-4989-8d86-a827fedd6624
type: derived