Windows: VS Code Tunnel Launching PowerShell or WSL/Bash Shell

title: "Windows: VS Code Tunnel Launching PowerShell or WSL/Bash Shell"
id: 39ac2d70-a7ac-4ff6-8b92-4284bbb4273e
status: test
description: This rule identifies process executions on Windows where a VS Code tunnel server process (node.exe under a Stable server path) spawns a shell. It focuses on PowerShell launching via a specific shell integration script and also flags WSL or bash execution. Attackers may leverage this pathway to run arbitrary commands through the tunnel, so correlating parent/command-line context helps distinguish suspicious tunnel-driven shell activity from normal use.
references:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://code.visualstudio.com/docs/remote/tunnels
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_remote_shell_.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \servers\Stable-
    ParentImage|endswith: \server\node.exe
    ParentCommandLine|contains: .vscode-server
  selection_child_1:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains: \terminal\browser\media\shellIntegration.ps1
  selection_child_2:
    Image|endswith:
      - \wsl.exe
      - \bash.exe
  condition: selection_parent and 1 of selection_child_*
falsepositives:
  - Legitimate use of Visual Studio Code tunnel and running code from there
level: medium
license: DRL-1.1
related:
  - id: f4a623c2-4ef5-4c33-b811-0642f702c9f1
    type: derived