devtunnel.exe

Enabling a forwarded port for locally hosted service at port 8080 to be exposed on the internet.

Use Download Files, Upload Files, Data Exfiltration

devtunnel.exe host -p 8080

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Download

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml

Sigma: github.com/SigmaHQ/sigma/blob/c7998c92b3c5f23ea67045bee8ee364d2ed1a775/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml

IOC: devtunnel.exe binary spawned

IOC: *.devtunnels.ms

IOC: *.*.devtunnels.ms

Analysis: cydefops.com/vscode-data-exfiltration

Refs

code.visualstudio.com/docs/editor/port-forwarding

lolbas-project.github.io/lolbas/OtherMSBinaries/devtunnel/