Query: rule covering Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling u
Matching passage: Sigma rule: Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling u. Logsource: windows / file_event. Rule: title: Renamed VsCode Code Tunnel Execution - File Indicator id: d102b8f5-61dc-4e68-bd83-9a3187c67377 status: test description: 'Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode. ' references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 tags: - attack.command-and-control logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \code_tunnel.json filter_main_legit_name: Image|endswith: - \code-tunnel.exe - \code.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc. Logsource: windows / image_load. Rule: title: Potential Antivirus Software DLL Sideloading id: 552b6b65-df37-4d3e-a258-f2fc4771ae54 status: test description: Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_bitdefender: ImageLoaded|endswith: \log.dll filter_log_dll_bitdefender: ImageLoaded|startswith: - C:\Program Files\Bitdefender Antivirus Free\ - C:\Program Files (x86)\Bitdefender Antivirus Free\ filter_log_dll_dell_sar: Image: C:\Program Files\Dell\SARemediation\audit\TelemetryUtility.exe ImageLoaded: - C:\Program Files\Dell\SARemediation\plugin\log.dll - C:\Program Files\Dell\SARemediation\audit\log.dll filter_log_dll_canon: ImageLoaded|startswith: C:\Program Files\Canon\MyPrinter\ filter_log_dll_avast: ImageLoaded: - C:\Program Files\AVAST Software\Avast\log.dll - C:\Program Files (x86)\AVAST Software\Avast\log.dll filter_log_dll_avg: ImageLoaded: - C:\Program Files\AVG\Antivirus\log.dll - C:\Program Files (x86)\AVG\Antivirus\log.dll selection_fsecure: ImageLoaded|endswith: \qrt.dll filter_fsecure: ImageLoaded|startswith: - C:\Program Files\F-Secure\Anti-Virus\ - C:\Program Files (x86)\F-Secure\Anti-Virus\ selection_mcafee: ImageLoaded|endswith: - \ashldres.dll - \lockdown.dll - \vsodscpl.dll filter_mcafee: ImageLoaded|startswith: - C:\Program Files\McAfee\ - C:\Program Files (x86)\McAfee\ selection_cyberark: ImageLoaded|endswith: \vftrace.dll filter_cyberark: ImageLoaded|startswith: - C:\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32\ - C:\Program Files (x86)\CyberArk\Endpoint Privilege Manager\Agent\x32\ selection_avast: ImageLoaded|endswith: \wsc.dll filter_wsc_dll_avast: ImageLoaded|startswith: - C:\program Files\AVAST Software\Avast\ - C:\program Files (x86)\AVAST Software\Avast\ filter_wsc_dll_avg: ImageLoaded|startswith: - C:\Program Files\AVG\Antivirus\ - C:\Program Files (x86)\AVG\Antivirus\ selection_eset_deslock: ImageLoaded|endswith: \DLPPREM32.dll filter_eset_deslock: ImageLoaded|startswith: - C:\program Files\ESET - C:\program Files (x86)\ESET selection_titanium: ImageLoaded|endswith: \tmdbglog.dll filter_titanium: ImageLoaded|startswith: - C:\program Files\Trend