LivingInSyn / RMML

A list of RMMs designed to be used in automation to build alerts
MIT License
106 stars 9 forks source link

Add Visual Studio Code tunnels to RMML #38

Closed LivingInSyn closed 3 weeks ago

LivingInSyn commented 3 weeks ago

Blog describing the method: https://medium.com/@truvis.thornton/visual-studio-code-embedded-reverse-shell-and-how-to-block-create-sentinel-detection-and-add-e864ebafaf6d

domains:

*.tunnels.api.visualstudio.com
*.devtunnels.ms

CLI (obviously for windows):

code\.exe.*tunnel.*