devtunnel.exe

type: OtherMSBinaries

Binary to enable forwarded ports on windows operating systems.

Full path

C:\Users\<username>\AppData\Local\Temp\.net\devtunnel\devtunnel.exe
C:\Users\<username>\AppData\Local\Temp\DevTunnels\devtunnel.exe

Commands

DownloadUser T1105
Download Files, Upload Files, Data Exfiltration
```
devtunnel.exe host -p 8080
```
Enabling a forwarded port for locally hosted service at port 8080 to be exposed on the internet.
os: Windows 10, Windows 11, MacOS

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml
Sigma https://github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml
IOCdevtunnel.exe binary spawned
IOC*.devtunnels.ms
IOC*.*.devtunnels.ms
Analysis https://cydefops.com/vscode-data-exfiltration

Resources

https://code.visualstudio.com/docs/editor/port-forwarding

acknowledgement: Kamran Saifullah @deFr0ggy