Skip to content

Commit e506e45

Browse files
deFr0ggynasbenchphantinuss
authored
Merge PR #4580 from @deFr0ggy - Update VsCode/DevTunnels Communication Related Rules
new: DNS Query To Devtunnels Domain - Split rule based on b3e6418f-7c7a-4fad-993a-93b65027a9f1 new: Network Connection Initiated To DevTunnels Domain new: Network Connection Initiated To Visual Studio Code Tunnels Domain update: DNS Query To Visual Studio Code Tunnels Domain - Update the rule to only focus on DNS requests from Vscode tunnels and move the logic of Devtunnels to another rule. To ease FP management for users that leverage one but not the other. --------- Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com> Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
1 parent 1cc2a6c commit e506e45

File tree

4 files changed

+109
-8
lines changed

4 files changed

+109
-8
lines changed

‎rules/windows/dns_query/dns_query_win_devtunnels_communication.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
title: DNS Query To Devtunnels Domain
2+
id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
3+
related:
4+
- id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 # Net Connection DevTunnels
5+
type: similar
6+
- id: 4b657234-038e-4ad5-997c-4be42340bce4 # Net Connection VsCode
7+
type: similar
8+
- id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 # DNS VsCode
9+
type: similar
10+
status: experimental
11+
description: |
12+
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
13+
references:
14+
- https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
15+
- https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
16+
- https://cydefops.com/devtunnels-unleashed
17+
author: citron_ninja
18+
date: 2023/10/25
19+
modified: 2023/11/20
20+
tags:
21+
- attack.command_and_control
22+
- attack.t1071.001
23+
logsource:
24+
category: dns_query
25+
product: windows
26+
detection:
27+
selection:
28+
QueryName|endswith: '.devtunnels.ms'
29+
condition: selection
30+
falsepositives:
31+
- Legitimate use of Devtunnels will also trigger this.
32+
level: medium

‎rules/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,22 @@
1-
title: DNS Query To Devtunnels And VsCode Tunnels
1+
title: DNS Query To Visual Studio Code Tunnels Domain
22
id: b3e6418f-7c7a-4fad-993a-93b65027a9f1
3+
related:
4+
- id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 # Net Connection DevTunnels
5+
type: similar
6+
- id: 4b657234-038e-4ad5-997c-4be42340bce4 # Net Connection VsCode
7+
type: similar
8+
- id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b # DNS DevTunnels
9+
type: similar
310
status: experimental
411
description: |
5-
Detects DNS query to Devtunnels and Visual Studio Code tunnel domains. Attackers can be abuse these features to establish a reverse shell.
12+
Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
613
references:
714
- https://ipfyx.fr/post/visual-studio-code-tunnel/
815
- https://badoption.eu/blog/2023/01/31/code_c2.html
9-
- https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
10-
- https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
16+
- https://cydefops.com/vscode-data-exfiltration
1117
author: citron_ninja
1218
date: 2023/10/25
19+
modified: 2023/11/20
1320
tags:
1421
- attack.command_and_control
1522
- attack.t1071.001
@@ -18,10 +25,8 @@ logsource:
1825
product: windows
1926
detection:
2027
selection:
21-
QueryName|endswith:
22-
- '.tunnels.api.visualstudio.com'
23-
- '.devtunnels.ms'
28+
QueryName|endswith: '.tunnels.api.visualstudio.com'
2429
condition: selection
2530
falsepositives:
26-
- Legitimate use of Visual Studio Code tunnel will also trigger this
31+
- Legitimate use of Visual Studio Code tunnel will also trigger this.
2732
level: medium

‎rules/windows/network_connection/net_connection_win_devtunnel_connection.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
title: Network Connection Initiated To DevTunnels Domain
2+
id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4
3+
related:
4+
- id: 4b657234-038e-4ad5-997c-4be42340bce4 # Net Connection VsCode
5+
type: similar
6+
- id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 # DNS VsCode
7+
type: similar
8+
- id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b # DNS DevTunnels
9+
type: similar
10+
status: experimental
11+
description: |
12+
Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
13+
references:
14+
- https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
15+
- https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
16+
- https://cydefops.com/devtunnels-unleashed
17+
author: Kamran Saifullah
18+
date: 2023/11/20
19+
tags:
20+
- attack.exfiltration
21+
- attack.t1567.001
22+
logsource:
23+
category: network_connection
24+
product: windows
25+
detection:
26+
selection:
27+
Initiated: 'true'
28+
DestinationHostname|endswith: '.devtunnels.ms'
29+
condition: selection
30+
falsepositives:
31+
- Legitimate use of Devtunnels will also trigger this.
32+
level: medium

‎rules/windows/network_connection/net_connection_win_vscode_tunnel_connection.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
title: Network Connection Initiated To Visual Studio Code Tunnels Domain
2+
id: 4b657234-038e-4ad5-997c-4be42340bce4
3+
related:
4+
- id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 # Net Connection DevTunnels
5+
type: similar
6+
- id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 # DNS VsCode
7+
type: similar
8+
- id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b # DNS DevTunnels
9+
type: similar
10+
status: experimental
11+
description: |
12+
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
13+
references:
14+
- https://ipfyx.fr/post/visual-studio-code-tunnel/
15+
- https://badoption.eu/blog/2023/01/31/code_c2.html
16+
- https://cydefops.com/vscode-data-exfiltration
17+
author: Kamran Saifullah
18+
date: 2023/11/20
19+
tags:
20+
- attack.exfiltration
21+
- attack.t1567.001
22+
logsource:
23+
category: network_connection
24+
product: windows
25+
detection:
26+
selection:
27+
Initiated: 'true'
28+
DestinationHostname|endswith: '.tunnels.api.visualstudio.com'
29+
condition: selection
30+
falsepositives:
31+
- Legitimate use of Visual Studio Code tunnel will also trigger this.
32+
level: medium

0 commit comments

Comments
 (0)