Windows Process Creation: Visual Studio Code Tunnel (.exe tunnel) Execution

title: "Windows Process Creation: Visual Studio Code Tunnel (.exe tunnel) Execution"
id: 78fc9242-008d-43c9-b726-c5b18d07e1ff
status: test
description: This rule identifies process executions where a command line ends with ".exe tunnel" and includes required tunnel license acceptance arguments. It further correlates the parent context to cmd.exe executing code-server.cmd from the Stable servers directory, which is a strong indicator of VS Code tunnel startup. Attackers may abuse this feature to establish an outbound command-and-control path, making this behavior valuable for detecting suspicious tunnel launches. Telemetry relies on Windows process creation fields including Image, ParentCommandLine, and CommandLine.
references:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://code.visualstudio.com/docs/remote/tunnels
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), citron_ninja, Huntrule Team
date: 2023-10-25
modified: 2025-10-29
tags:
  - attack.command-and-control
  - attack.t1071.001
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_only_tunnel:
    OriginalFileName: null
    CommandLine|endswith: .exe tunnel
  selection_tunnel_args:
    CommandLine|contains|all:
      - .exe tunnel
      - --accept-server-license-terms
  selection_parent_tunnel:
    ParentCommandLine|endswith: " tunnel"
    Image|endswith: \cmd.exe
    CommandLine|contains|all:
      - "/d /c "
      - \servers\Stable-
      - code-server.cmd
  condition: 1 of selection_*
falsepositives:
  - Legitimate use of Visual Studio Code tunnel
level: medium
license: DRL-1.1
related:
  - id: 90d6bd71-dffb-4989-8d86-a827fedd6624
    type: derived