Network Connection Initiated To Visual Studio Code Tunnels Domain

Title: Network Connection Initiated To Visual Studio Code Tunnels Domain
Status: test
Description:Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
References:
  -https://ipfyx.fr/post/visual-studio-code-tunnel/
  -https://badoption.eu/blog/2023/01/31/code_c2.html
  -https://cydefops.com/vscode-data-exfiltration
Author: Kamran Saifullah
Date: 2023-11-20
modified:None
Tags:

• -'attack.exfiltration'
• -'attack.command-and-control'
• -'attack.t1567'
• -'attack.t1572'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Initiated: 'true'
    DestinationHostname|endswith: '.tunnels.api.visualstudio.com'
  condition:selection
Falsepositives:
  -Legitimate use of Visual Studio Code tunnel will also trigger this.
Level: medium