Techniques › T1219 › T1219.001
T1219.001 IDE Tunneling
command and control — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1219.001
0
KEV CVEs mapped here
<p>Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g.,
code tunnel) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.</p><p>Additionally, adversaries may use IDE tunneling for persistence. Some IDEs, such as Visual Studio Code and JetBrains, support automatic reconnection. Adversaries may configure the IDE to auto-launch at startup, re-establishing the tunnel upon execution. Compromised developer machines may also be exploited as jump hosts to move further into the network.</p><p>IDE tunneling tools may be built-in or installed as IDE Extensions.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0133 IDE Tunneling Detection via Process, File, and Network Behaviors v1.0
AN0375 WindowsDetection of the creation of VSCode or JetBrains CLI tunneling profiles followed by persistent remote access via IDE-integrated tunnels, potentially authenticated via GitHub or JetBrains accounts.NSM:Flow
Outbound connection to *.tunnels.api.visualstudio.com or *.devtunnels.ms→ DC0082 Network Connection CreationTunable:TimeWindowTunnelDomainPatternsAuthorizedUserListAN0376 LinuxCreation of VSCode tunnel configuration file combined with interactive remote session via code CLI or ssh with JetBrains gateway.NSM:FlowConnections to *.devtunnels.ms or tunnels.api.visualstudio.com→ DC0082 Network Connection CreationTunable:PathRegexTunnelCLIFlagsUsernameTunnelArtifactPathCommandLineFlagsAN0377 macOSDetection of JetBrains or VSCode tunnel profile creation followed by unusual persistent SSH or IDE-based tunnel communications to devtunnel APIs.macos:unifiedlogprocess: code or jetbrains-gateway launching with --tunnel or --remote→ DC0032 Process CreationTunable:ParentProcessNameRemoteTunnelPersistenceRemoteFlagLaunchAgentPathTunnelReconnectInterval
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1219.001
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1219) 6
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-28 (modified 2025-10-29) · logsource: product=windows category=process_creation · 2cf29f11-e356-4f61-98c0-1bdb9393d6da
Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server
mediumexperimental
Author: Ahmed Nosir (@egycondor)
· 2025-05-29 · logsource: product=windows category=process_creation · 2db93a3f-3249-4f73-9e68-0e77a0f8ae7e
Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line.
These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.
This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-08-29 · logsource: product=windows category=process_creation · 4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.
Author: @kostastsale
· 2026-02-19 · logsource: product=windows category=process_creation · 7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d
Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities.
This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool.
Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.
Author: Nasreddine Bencherchali (Nextron Systems), citron_ninja
· 2023-10-25 (modified 2025-10-29) · logsource: product=windows category=process_creation · 90d6bd71-dffb-4989-8d86-a827fedd6624
Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Author: @kostastsale
· 2026-02-19 · logsource: product=windows category=file_event · 9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d
Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.
The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.
While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.