HI,
There are allready some rules :

• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml
• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_renamed_execution.yml
• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml
• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml

I'm surprised by the the field ProcessVersionInfoProductName

HI, There are allready some rules :

• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml
• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_renamed_execution.yml
• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml
• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml

I'm surprised by the the field ProcessVersionInfoProductName

This is not only vscode it also cater for devtunnel commandline parameters https://detect.fyi/detecting-dev-tunnels-16f0994dc3e2. I didn't see that in the repo hence the new rule

@frack113 Thank you I commited the changes. this is my first sigma rule so your help is much appreciated

HI, There are allready some rules :

• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml
• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_renamed_execution.yml
• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml
• https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml

I'm surprised by the the field ProcessVersionInfoProductName

Apart from EDR ProcessVersionInfoProductName this will be available in sysmon log so not sure if I should keep it to windows events or put sysmon in there? @frack113 @nasbench. can also change it to Image if that works

ProcessVersionInfoProductName

In the sysmon event (but not in the windows 4688) you have:

• Description
• Product
• Company
• OriginalFileName

Can be somethink like this

    selection_exe:
        - Image|endswith:
            - '\code.exe'
            - '\devtunnel.exe'
        - OriginalFileName:
            - 'code.exe' ???
            - 'devtunnel.exe' ???
    selection_cli_tunel:
        CommandLine|contains: 'tunnel'
    selection_cli_temporary:
    selection_cli_persistent:
    condition: selection_exe and 1 of selection_cli_*