Elastic Defend high stable eql

Potential VScode Remote Tunnel Established

Detects the rename or modification of the code_tunnel json file which gets created or modified when a remote tunnel session is created via the VScode portable binary.

View Source

Detection Logic

file where event.action != "deletion" and file.name : "code_tunnel.json" and
not process.executable : "C:\\Windows\\explorer.exe"

Field Validations

Loading…

Comments (0)

Loading comments...