Visual Studio Code CLI starting a remote tunnel

Siemphony@siemphonymediumT1219.001unverifiedPlaybook · Command and control

AN0375 pairs the creation of an IDE tunnelling profile with the persistent remote session that follows, and the process-creation half of that pair is a single event: the Visual Studio Code CLI invoked with the `tunnel` verb, which is what registers the machine with the vendor's relay and yields a browser-reachable session over an outbound connection. Both the desktop installation and the standalone CLI are covered, because `code tunnel` on a desktop install delegates to the separate `code-tunnel.exe` shipped beside it and matching only `code.exe` would miss the process that actually holds the tunnel. The same verb covers the persistence variant — `tunnel service install` registers the tunnel to start at logon — so re-registration after a reboot appears here too. The JetBrains Gateway leg of the analytic is deliberately not written: its Windows launcher name varies with the Toolbox installation and a guessed binary name would be a selector that can never fire. MITRE's TunnelDomainPatterns knob applies to the network leg of the strategy, which this event does not carry; corroborate a hit with the `.vscode-cli\code_tunnel.json` profile write (Sysmon EventID 11), the other log source in this analytic. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0133, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Visual Studio Code CLI starting a remote tunnel2id: aa430f16-6a4c-4b99-a56b-903194e3f4733status: experimental4description: |5  AN0375 pairs the creation of an IDE tunnelling profile with the persistent6  remote session that follows, and the process-creation half of that pair is a7  single event: the Visual Studio Code CLI invoked with the `tunnel` verb, which8  is what registers the machine with the vendor's relay and yields a9  browser-reachable session over an outbound connection. Both the desktop10  installation and the standalone CLI are covered, because `code tunnel` on a11  desktop install delegates to the separate `code-tunnel.exe` shipped beside it12  and matching only `code.exe` would miss the process that actually holds the13  tunnel. The same verb covers the persistence variant — `tunnel service14  install` registers the tunnel to start at logon — so re-registration after a15  reboot appears here too. The JetBrains Gateway leg of the analytic is16  deliberately not written: its Windows launcher name varies with the Toolbox17  installation and a guessed binary name would be a selector that can never18  fire. MITRE's TunnelDomainPatterns knob applies to the network leg of the19  strategy, which this event does not carry; corroborate a hit with the20  `.vscode-cli\code_tunnel.json` profile write (Sysmon EventID 11), the other21  log source in this analytic.22  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0133, not hand-written and not tested by its author. Any lab result is on this rule's own page.23references:24  - https://attack.mitre.org/techniques/T1219/00125  - https://attack.mitre.org/detectionstrategies/DET013326author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)27date: 2026-08-1628tags:29  - attack.command-and-control30  - attack.t1219.00131logsource:32  category: process_creation33  product: windows34detection:35  selection_image:36    Image|endswith:37      - '\code.exe'38      - '\code-tunnel.exe'39      - '\code-insiders.exe'40  selection_verb:41    CommandLine|contains: ' tunnel'42  condition: selection_image and selection_verb43falsepositives:44  - "Sanctioned remote development. A developer running `code tunnel` to reach their own workstation or a build VM produces exactly this event; on an engineering estate this is the dominant source of matches and only the account and the host it runs on separate it from abuse, which is what MITRE's AuthorizedUserList knob is for."45  - "The tunnel service restarting. Once `tunnel service install` has been run legitimately, every logon re-launches the CLI with the same verb, so one approved setup keeps generating events indefinitely."46  - "Support and lab automation that stands up a tunnel into a short-lived test or demo machine as part of provisioning, run by IT rather than by the machine's user."47level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\code.exe" or FolderPath endswith "\\code-tunnel.exe" or FolderPath endswith "\\code-insiders.exe") and ProcessCommandLine contains " tunnel")

Splunk · SPL

Run this as a search.

index=* ((Image="*\\code.exe" OR Image="*\\code-tunnel.exe" OR Image="*\\code-insiders.exe") AND CommandLine="* tunnel*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\code.exe" OR TO_LOWER(process.executable) LIKE "*\\\\code-tunnel.exe" OR TO_LOWER(process.executable) LIKE "*\\\\code-insiders.exe") AND TO_LOWER(process.command_line) LIKE "* tunnel*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\code\.exe$|\\code-tunnel\.exe$|\\code-insiders\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i) tunnel</field>    <description>Visual Studio Code CLI starting a remote tunnel</description>    <mitre>      <id>T1219.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: reverse_shell
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: aa430f16-6a4c-4b99-a56b-903194e3f473

ATT&CKT1219.001

T1219.001IDE Tunneling

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1219.001, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Scope by population before you tune by content. Run the rule against hosts with no development role and the noise largely disappears; run it against a developer fleet and it is an inventory, not an alert. Populate AuthorizedUserList from your actual VSCode install base and suppress that pairing of user and host, not the user alone. Then corroborate: join a hit to the code_tunnel.json write and to outbound traffic to the tunnel relay domains, which is where TunnelDomainPatterns applies. If Gateway matters at your site, observe the launcher name on a real install and add it — do not guess it.

Declared by the author

Sanctioned remote development. A developer running code tunnel to reach their own workstation or a build VM produces exactly this event; on an engineering estate this is the dominant source of matches and only the account and the host it runs on separate it from abuse, which is what MITRE's AuthorizedUserList knob is for.
The tunnel service restarting. Once tunnel service install has been run legitimately, every logon re-launches the CLI with the same verb, so one approved setup keeps generating events indefinitely.
Support and lab automation that stands up a tunnel into a short-lived test or demo machine as part of provisioning, run by IT rather than by the machine's user.

Lessonreverse shell

reverse shellAI draft — unreviewed

01 · What this rule detects

An IDE remote tunnel being started on a Windows host. MITRE's AN0375 pairs the creation of a VSCode or JetBrains tunnelling profile with the persistent remote session that follows. Only the first half of that pair fits in one process-creation event, and this rule takes it: the Visual Studio Code CLI invoked with the tunnel verb, which registers the machine with the vendor's relay and yields a browser-reachable session over a purely outbound connection — no inbound firewall change, no third-party RMM binary on disk.

02 · Telemetry you need

Windows process creation with the command line populated. Sysmon EventID 1 supplies Image and CommandLine and is the vocabulary this rule is written in. If Security 4688 feeds the category instead, CommandLine is only populated when both Audit Process Creation and the separate Include command line in process creation events policy are enabled, and the field is empty otherwise — the selection then never matches. The analytic's other log source is file creation (Sysmon EventID 11) of .vscode-cli\code_tunnel.json, which is the corroborating artefact rather than part of this rule.

03 · How the logic works

Two blocks, ANDed. selection_image matches Image|endswith against \code.exe, \code-tunnel.exe and \code-insiders.exe. selection_verb matches CommandLine|contains: ' tunnel' — with the leading space, so it hits the verb rather than any path fragment containing the word. Both binaries are listed for a reason worth remembering: code tunnel on a desktop install delegates the work to the separate code-tunnel.exe shipped beside it, so matching only code.exe would catch the launcher and miss the process that actually holds the tunnel open. The same verb also covers the persistence variant, since tunnel service install registers the tunnel to start at logon — which means re-registration after every reboot appears here too. The JetBrains Gateway leg of AN0375 is deliberately not written. Its Windows launcher name varies with the Toolbox installation, and a guessed name would produce a selector that validates cleanly, renders in four backends and can never fire. MITRE's TunnelDomainPatterns knob belongs to the network leg of the strategy, which this event does not carry at all.

04 · Common false positives

On an engineering estate, sanctioned remote development is the dominant source of matches — a developer reaching their own workstation or a build VM produces byte-for-byte this event, and only the account and the host separate it from abuse. That is exactly what MITRE's AuthorizedUserList knob exists for. The service-install variant compounds it: one approved setup keeps generating the same event at every logon indefinitely. Support and lab automation that stands up a tunnel into a short-lived test or demo machine adds a third stream, run by IT rather than by the machine's user. The level is medium rather than lower because on a non-developer population — finance, HR, a server segment — this event has no benign explanation at all.

05 · Detection maturity

tier_1: Lowest tier until the rule has been run against real data. It is machine- derived from a MITRE scaffold and has never been executed against a log line, so there is no confirmed true positive, no false-positive rate and no evidence the verb match holds against real command lines. Search history first, count the distinct users, and let that decide whether this is an alert or a hunt.

Share this rule

/u/siemphony/aa430f16-6a4c-4b99-a56b-903194e3f473

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Visual Studio Code CLI starting a remote tunnel

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it