Windows: VS Code Tunnel Launching PowerShell or WSL/Bash Shell

Flags VS Code tunnel (node.exe) spawning PowerShell, WSL, or bash shell processes on Windows.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-10-25
Updated: 2026-07-30

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1071.001Web Protocols
Exfiltration
Impact

What it detects

This rule identifies process executions on Windows where a VS Code tunnel server process (node.exe under a Stable server path) spawns a shell. It focuses on PowerShell launching via a specific shell integration script and also flags WSL or bash execution. Attackers may leverage this pathway to run arbitrary commands through the tunnel, so correlating parent/command-line context helps distinguish suspicious tunnel-driven shell activity from normal use.

Reporting behind it

Related detections9 linkedT1071.001 — drag to rearrange

Malicious HarborWatch RAT Command and Control Beacon by User Agent (via proxy)

Suspicious UAT-10608 Credential Harvesting C2 Beacon via HTTP

Malicious BadIIS C2 Communication via lwxatisme User-Agent

Possible PS1Bot C2 Beacon With Drive Serial URI Pattern (via proxy)

Suspicious WarmCookie C2 Beacon With Fixed Firefox User-Agent

Malicious Renamed Python Interpreter Executing nvidia.py RAT

Malicious Self-Signed TLS Certificate With Exploit Subject via Zeek X509

Suspicious Network Connection From wabmig.exe (Turian Injection)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Windows: VS Code Tunnel Launching PowerShell or WSL/Bash Shell

Pivot detection · T1071.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-vs-code-tunnel-launching-powershell-or-wsl-bash-shell-f4a623c2

title: "Windows: VS Code Tunnel Launching PowerShell or WSL/Bash Shell"
id: 39ac2d70-a7ac-4ff6-8b92-4284bbb4273e
status: test
description: This rule identifies process executions on Windows where a VS Code tunnel server process (node.exe under a Stable server path) spawns a shell. It focuses on PowerShell launching via a specific shell integration script and also flags WSL or bash execution. Attackers may leverage this pathway to run arbitrary commands through the tunnel, so correlating parent/command-line context helps distinguish suspicious tunnel-driven shell activity from normal use.
references:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://code.visualstudio.com/docs/remote/tunnels
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_remote_shell_.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-10-25
tags:
  - attack.command-and-control
  - attack.t1071.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \servers\Stable-
    ParentImage|endswith: \server\node.exe
    ParentCommandLine|contains: .vscode-server
  selection_child_1:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains: \terminal\browser\media\shellIntegration.ps1
  selection_child_2:
    Image|endswith:
      - \wsl.exe
      - \bash.exe
  condition: selection_parent and 1 of selection_child_*
falsepositives:
  - Legitimate use of Visual Studio Code tunnel and running code from there
level: medium
license: DRL-1.1
related:
  - id: f4a623c2-4ef5-4c33-b811-0642f702c9f1
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL