Windows Process Creation: VS Code Tunnel (code-tunnel) Installed as a Service

Alerts on Windows process command lines consistent with installing VS Code tunnel (code-tunnel) as a service.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-10-25
Updated: 2026-07-30

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule flags Windows process executions whose command line contains the tunnel/service combination and internal-run logging, indicating installation of the VS Code tunnel (code-tunnel) as a Windows service. Attackers can use this tunneling capability to establish remote connectivity and blend it into normal tooling. The detection relies on process creation telemetry, specifically the full command line containing 'tunnel ', 'service', 'internal-run', and 'tunnel-service.log'.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious Agent Tesla Loader Malformed User-Agent in HTTP Traffic (via proxy)

Malicious Interlock RAT FileFix Download-Cradle via PowerShell WebClient with PowerShell User-Agent (via ps_script)

Suspicious Cobalt Strike Malleable Profile Beaconing via Legacy MSIE9 User-Agent and IE Compatibility URIs (via proxy)

Malicious Cobalt Strike Default Named Pipe Activity

Malicious VoidLink Kernel Rootkit C2 Endpoints via HTTP (via proxy)

Malicious EtherRAT C2 Exfiltration Endpoints via HTTP (via proxy)

Possible PlugX and NPS Proxy Command and Control Domain Lookup

Possible Backdoor Mistic Command and Control Domain Lookup

Suspicious Weaver Ant In-Memory Web Shell Marker in Web Request (via webserver)

Windows Process Creation: VS Code Tunnel (code-tunnel) Installed as a Service

Pivot detection · T1071.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-vs-code-tunnel-code-tunnel-installed-as-a-service-30bf1789

title: "Windows Process Creation: VS Code Tunnel (code-tunnel) Installed as a Service"
id: 400a6648-8622-4668-955e-7131113f9e33
status: test
description: This rule flags Windows process executions whose command line contains the tunnel/service combination and internal-run logging, indicating installation of the VS Code tunnel (code-tunnel) as a Windows service. Attackers can use this tunneling capability to establish remote connectivity and blend it into normal tooling. The detection relies on process creation telemetry, specifically the full command line containing 'tunnel ', 'service', 'internal-run', and 'tunnel-service.log'.
references:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://code.visualstudio.com/docs/remote/tunnels
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - "tunnel "
      - service
      - internal-run
      - tunnel-service.log
  condition: selection
falsepositives:
  - Legitimate installation of code-tunnel as a service
level: medium
license: DRL-1.1
related:
  - id: 30bf1789-379d-4fdc-900f-55cd0a90a801
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL