Windows Process Creation: VS Code Tunnel (code-tunnel) Installed as a Service
Alerts on Windows process command lines consistent with installing VS Code tunnel (code-tunnel) as a service.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-10-25
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process executions whose command line contains the tunnel/service combination and internal-run logging, indicating installation of the VS Code tunnel (code-tunnel) as a Windows service. Attackers can use this tunneling capability to establish remote connectivity and blend it into normal tooling. The detection relies on process creation telemetry, specifically the full command line containing 'tunnel ', 'service', 'internal-run', and 'tunnel-service.log'.
Reporting behind it
- ipfyx.frhttps://ipfyx.fr/post/visual-studio-code-tunnel/
- badoption.euhttps://badoption.eu/blog/2023/01/31/code_c2.html
- code.visualstudio.comhttps://code.visualstudio.com/docs/remote/tunnels
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: VS Code Tunnel (code-tunnel) Installed as a Service"
id: 400a6648-8622-4668-955e-7131113f9e33
status: test
description: This rule flags Windows process executions whose command line contains the tunnel/service combination and internal-run logging, indicating installation of the VS Code tunnel (code-tunnel) as a Windows service. Attackers can use this tunneling capability to establish remote connectivity and blend it into normal tooling. The detection relies on process creation telemetry, specifically the full command line containing 'tunnel ', 'service', 'internal-run', and 'tunnel-service.log'.
references:
- https://ipfyx.fr/post/visual-studio-code-tunnel/
- https://badoption.eu/blog/2023/01/31/code_c2.html
- https://code.visualstudio.com/docs/remote/tunnels
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- "tunnel "
- service
- internal-run
- tunnel-service.log
condition: selection
falsepositives:
- Legitimate installation of code-tunnel as a service
level: medium
license: DRL-1.1
related:
- id: 30bf1789-379d-4fdc-900f-55cd0a90a801
type: derived