huntrule

Windows Network Connections to Visual Studio Code Tunnels Domain

Alerts on initiated network connections to .tunnels.api.visualstudio.com from a Windows process.

FreeReviewedSigma · Medium · v2
Product
windows
Category
network_connection
Author
Kamran Saifullah (SigmaHQ), DRL 1.1
Published
2023-11-20
Updated
2026-07-31
AnalysisDetection
title: Windows Network Connections to Visual Studio Code Tunnels Domain
id: 2852ad9c-efd1-483a-bb45-a29314bb6176
related:
  - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
    type: similar
  - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1
    type: similar
  - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
    type: similar
  - id: 4b657234-038e-4ad5-997c-4be42340bce4
    type: derived
status: test
description: This rule flags outbound network connections initiated by a process where the destination hostname ends with .tunnels.api.visualstudio.com. Such connections may indicate use of Visual Studio Code tunneling, which attackers could potentially leverage for command-and-control style access or persistence. Telemetry required includes Windows network connection events with destination hostname and an initiated-connection indicator.
references:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://cydefops.com/vscode-data-exfiltration
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_vscode_tunnel_connection.yml
author: Kamran Saifullah, Huntrule Team
date: 2023-11-20
tags:
  - attack.exfiltration
  - attack.command-and-control
  - attack.t1567
  - attack.t1572
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: "true"
    DestinationHostname|endswith: .tunnels.api.visualstudio.com
  condition: selection
falsepositives:
  - Legitimate use of Visual Studio Code tunnel will also trigger this.
level: medium
license: DRL-1.1