Windows Process Initiated Network Connections to Visual Studio Code Tunnel Domains

title: Windows Process Initiated Network Connections to Visual Studio Code Tunnel Domains
id: 2852ad9c-efd1-483a-bb45-a29314bb6176
related:
  - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
    type: similar
  - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1
    type: similar
  - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
    type: similar
  - id: 4b657234-038e-4ad5-997c-4be42340bce4
    type: derived
status: test
description: This rule flags Windows network connections where the initiating process has set the connection as initiated and the destination hostname ends with .tunnels.api.visualstudio.com. Such connectivity matters because it can enable attacker-controlled relays, including command-and-control channels, by leveraging Visual Studio Code tunnel functionality. It relies on Windows network connection telemetry that includes a connection initiation indicator and destination hostname.
references:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://cydefops.com/vscode-data-exfiltration
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_vscode_tunnel_connection.yml
author: Kamran Saifullah, Huntrule Team
date: 2023-11-20
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567
  - attack.t1572
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith: .tunnels.api.visualstudio.com
  condition: selection
falsepositives:
  - Legitimate use of Visual Studio Code tunnel will also trigger this.
level: medium
license: DRL-1.1