Windows Process Creation: VS Code Tunnel (code-tunnel) Installed as a Service

title: "Windows Process Creation: VS Code Tunnel (code-tunnel) Installed as a Service"
id: 400a6648-8622-4668-955e-7131113f9e33
status: test
description: This rule flags Windows process executions whose command line contains the tunnel/service combination and internal-run logging, indicating installation of the VS Code tunnel (code-tunnel) as a Windows service. Attackers can use this tunneling capability to establish remote connectivity and blend it into normal tooling. The detection relies on process creation telemetry, specifically the full command line containing 'tunnel ', 'service', 'internal-run', and 'tunnel-service.log'.
references:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://code.visualstudio.com/docs/remote/tunnels
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - "tunnel "
      - service
      - internal-run
      - tunnel-service.log
  condition: selection
falsepositives:
  - Legitimate installation of code-tunnel as a service
level: medium
license: DRL-1.1
related:
  - id: 30bf1789-379d-4fdc-900f-55cd0a90a801
    type: derived