Elastic medium stable eql

Attempt to Establish VScode Remote Tunnel

Detects the execution of the VScode portable binary with the tunnel command line option indicating an attempt to establish a remote tunnel session to Github or a remote VScode instance.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
  process.args : "tunnel" and
  (process.args : "--accept-server-license-terms" or
   process.name : "code*.exe" or
   ?process.code_signature.subject_name : "Microsoft Corporation" or
   process.executable : ("?:\\ProgramData\\*", "?:\\Users\\Public\\*", "?:\\windows\\debug\\*", 
                         "\\Device\\HarddiskVolume*\\Users\\Public\\*", "\\Device\\HarddiskVolume*\\ProgramData\\*",  "\\Device\\HarddiskVolume*\\windows\\debug\\*")) and
  not (process.name == "code-tunnel.exe" and process.args == "status" and process.parent.name == "Code.exe")

Field Validations

Loading…

Comments (0)

Loading comments...