Techniques › T1219.001 › AN0376
AN0376 Analytic 0376
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Creation of VSCode tunnel configuration file combined with interactive remote session via code CLI or ssh with JetBrains gateway.</p>
- Detects
- T1219.001 IDE Tunneling
- Part of
- DET0133 IDE Tunneling Detection via Process, File, and Network Behaviors
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve on code or jetbrains-gateway with remote flags | DC0032 Process Creation |
| auditd:SYSCALL | open: Write to ~/.vscode-cli/code_tunnel.json | DC0039 File Creation |
| NSM:Flow | Connections to *.devtunnels.ms or tunnels.api.visualstudio.com | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PathRegex | Regex patterns for user home directory file paths may vary by distro or user. |
TunnelCLIFlags | Tunnel flags used by CLI tools can be customized or obfuscated by adversaries. |
Username | The Linux user account associated with tunnel initiation; may vary across developer environments |
TunnelArtifactPath | The filepath to the .vscode-cli/code_tunnel.json file may vary by distribution or IDE version |
CommandLineFlags | Different IDEs or wrapper scripts may launch with different tunnel-related CLI options (e.g., --remote, --host) |