Windows Network Connections to Visual Studio Code Tunnels Domain
Alerts on initiated network connections to .tunnels.api.visualstudio.com from a Windows process.
- Product
- windows
- Category
- network_connection
- Author
- Kamran Saifullah (SigmaHQ), DRL 1.1
- Published
- 2023-11-20
- Updated
- 2026-07-31
ATT&CK techniques
C2 → ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags outbound network connections initiated by a process where the destination hostname ends with .tunnels.api.visualstudio.com. Such connections may indicate use of Visual Studio Code tunneling, which attackers could potentially leverage for command-and-control style access or persistence. Telemetry required includes Windows network connection events with destination hostname and an initiated-connection indicator.
Reporting behind it
- ipfyx.frhttps://ipfyx.fr/post/visual-studio-code-tunnel/
- badoption.euhttps://badoption.eu/blog/2023/01/31/code_c2.html
- cydefops.comhttps://cydefops.com/vscode-data-exfiltration
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_vscode_tunnel_connection.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Network Connections to Visual Studio Code Tunnels Domain
id: 2852ad9c-efd1-483a-bb45-a29314bb6176
related:
- id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
type: similar
- id: b3e6418f-7c7a-4fad-993a-93b65027a9f1
type: similar
- id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
type: similar
- id: 4b657234-038e-4ad5-997c-4be42340bce4
type: derived
status: test
description: This rule flags outbound network connections initiated by a process where the destination hostname ends with .tunnels.api.visualstudio.com. Such connections may indicate use of Visual Studio Code tunneling, which attackers could potentially leverage for command-and-control style access or persistence. Telemetry required includes Windows network connection events with destination hostname and an initiated-connection indicator.
references:
- https://ipfyx.fr/post/visual-studio-code-tunnel/
- https://badoption.eu/blog/2023/01/31/code_c2.html
- https://cydefops.com/vscode-data-exfiltration
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_vscode_tunnel_connection.yml
author: Kamran Saifullah, Huntrule Team
date: 2023-11-20
tags:
- attack.exfiltration
- attack.command-and-control
- attack.t1567
- attack.t1572
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: "true"
DestinationHostname|endswith: .tunnels.api.visualstudio.com
condition: selection
falsepositives:
- Legitimate use of Visual Studio Code tunnel will also trigger this.
level: medium
license: DRL-1.1