Windows: VS Code Tunnel Launching PowerShell or WSL/Bash Shell
Flags VS Code tunnel (node.exe) spawning PowerShell, WSL, or bash shell processes on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-10-25
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies process executions on Windows where a VS Code tunnel server process (node.exe under a Stable server path) spawns a shell. It focuses on PowerShell launching via a specific shell integration script and also flags WSL or bash execution. Attackers may leverage this pathway to run arbitrary commands through the tunnel, so correlating parent/command-line context helps distinguish suspicious tunnel-driven shell activity from normal use.
Reporting behind it
- ipfyx.frhttps://ipfyx.fr/post/visual-studio-code-tunnel/
- badoption.euhttps://badoption.eu/blog/2023/01/31/code_c2.html
- code.visualstudio.comhttps://code.visualstudio.com/docs/remote/tunnels
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_remote_shell_.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: VS Code Tunnel Launching PowerShell or WSL/Bash Shell"
id: 39ac2d70-a7ac-4ff6-8b92-4284bbb4273e
status: test
description: This rule identifies process executions on Windows where a VS Code tunnel server process (node.exe under a Stable server path) spawns a shell. It focuses on PowerShell launching via a specific shell integration script and also flags WSL or bash execution. Attackers may leverage this pathway to run arbitrary commands through the tunnel, so correlating parent/command-line context helps distinguish suspicious tunnel-driven shell activity from normal use.
references:
- https://ipfyx.fr/post/visual-studio-code-tunnel/
- https://badoption.eu/blog/2023/01/31/code_c2.html
- https://code.visualstudio.com/docs/remote/tunnels
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_remote_shell_.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains: \servers\Stable-
ParentImage|endswith: \server\node.exe
ParentCommandLine|contains: .vscode-server
selection_child_1:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains: \terminal\browser\media\shellIntegration.ps1
selection_child_2:
Image|endswith:
- \wsl.exe
- \bash.exe
condition: selection_parent and 1 of selection_child_*
falsepositives:
- Legitimate use of Visual Studio Code tunnel and running code from there
level: medium
license: DRL-1.1
related:
- id: f4a623c2-4ef5-4c33-b811-0642f702c9f1
type: derived