DNS Query To Visual Studio Code Tunnels Domain

Title: DNS Query To Visual Studio Code Tunnels Domain
Status: test
Description:Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
References:
  -https://ipfyx.fr/post/visual-studio-code-tunnel/
  -https://badoption.eu/blog/2023/01/31/code_c2.html
  -https://cydefops.com/vscode-data-exfiltration
Author: citron_ninja
Date: 2023-10-25
modified:2023-11-20
Tags:

• -'attack.command-and-control'
• -'attack.t1071.001'

Logsource:

• product: windows
• category: dns_query

Detection:
  selection:
    QueryName|endswith: '.tunnels.api.visualstudio.com'
  condition:selection
Falsepositives:
  -Legitimate use of Visual Studio Code tunnel will also trigger this.
Level: medium