Elastic Defend high stable eql

Attempt to establish VScode Remote Tunnel

Detects the execution of the VScode portable binary with the tunnel command line option indicating an attempt to establish a remote tunnel session to Github or a remote VScode instance.

View Source

Detection Logic

process where event.type == "start" and event.action in ("exec", "start") and 
 process.name : ("code", "code.exe") and process.args : "tunnel" and 
 not (process.name : "code-tunnel*.exe" and process.args  : ("status", "--log-to-file"))

Field Validations

Loading…

Comments (0)

Loading comments...