Mustang PandaG0129 ↗
Has utilized an established Github account to create a tunnel within the victim environment using Visual Studio Code through the code.exe tunnel command.1
- Tactic
- Command and Control
- Platforms
- Linux, macOS, Windows
- Version
- 1.0
- Created
- 20 March 2025
- Last modified
- 12 May 2026
- Contributor
- Purinut Wongwaiwuttiguldej
Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., code tunnel) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.[1][2][3]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.IDE Tunneling MITRE reference T1219.001
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation Digital EyeC0061 ↗
During Operation Digital Eye, threat actors created Visual Studio Code dev tunnels to access targeted endpoints through the browser-based version of Visual Studio Code.1
Operation AkaiRyūC0060 ↗
During Operation AkaiRyū, MirrorFace abused Visual Studio Code (VS Code) remote tunnels to gain access and execute code on compromised machines.1
All 2 campaigns for this technique
Offense vs defense T1219.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
IDE Tunneling detection strategy DET0133
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
IDE Tunneling Detection via Process, File, and Network Behaviors
3 platforms
AN0375 · Windows
Detection of the creation of VSCode or JetBrains CLI tunneling profiles followed by persistent remote access via IDE-integrated tunnels, potentially authenticated via GitHub or JetBrains accounts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Connection CreationDC0082 | NSM:Flow | Outbound connection to *.tunnels.api.visualstudio.com or *.devtunnels.ms |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Used to define the temporal proximity between tunnel profile creation and outbound connection. |
| TunnelDomainPatterns | Domain patterns for tunnel endpoints may change with IDE versions or organizations. |
| AuthorizedUserList | Helps filter tunnel usage from trusted developer accounts. |
AN0376 · Linux
Creation of VSCode tunnel configuration file combined with interactive remote session via code CLI or ssh with JetBrains gateway.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve on code or jetbrains-gateway with remote flags |
| File CreationDC0039 | auditd:SYSCALL | open: Write to ~/.vscode-cli/code_tunnel.json |
| Network Connection CreationDC0082 | NSM:Flow | Connections to *.devtunnels.ms or tunnels.api.visualstudio.com |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PathRegex | Regex patterns for user home directory file paths may vary by distro or user. |
| TunnelCLIFlags | Tunnel flags used by CLI tools can be customized or obfuscated by adversaries. |
| Username | The Linux user account associated with tunnel initiation; may vary across developer environments |
| TunnelArtifactPath | The filepath to the .vscode-cli/code_tunnel.json file may vary by distribution or IDE version |
| CommandLineFlags | Different IDEs or wrapper scripts may launch with different tunnel-related CLI options (e.g., --remote, --host) |
AN0377 · macOS
Detection of JetBrains or VSCode tunnel profile creation followed by unusual persistent SSH or IDE-based tunnel communications to devtunnel APIs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | process: code or jetbrains-gateway launching with --tunnel or --remote |
| File CreationDC0039 | macos:unifiedlog | creation of ~/.vscode-cli/code_tunnel.json |
| Network Connection CreationDC0082 | NSM:Flow | HTTPs connection to tunnels.api.visualstudio.com |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentProcessName | Helps scope tunnel launch context to non-interactive or suspicious parent processes. |
| RemoteTunnelPersistence | Allows tracking of tunnel re-establishment across reboots for persistence. |
| RemoteFlag | May include values like --remote, -R, or embedded ssh arguments passed by IDEs |
| LaunchAgentPath | If the IDE uses persistence via LaunchAgents, defenders may choose where to monitor for tunnel auto-launching |
| TunnelReconnectInterval | Frequency of retry attempts for tunnel reconnection can affect correlation window |
Execution PreventionM1038
Use Group Policies to require user authentication by disabling anonymous tunnel access, preventing any unauthenticated tunnel creation or usage. Disable the Visual Studio Dev Tunnels feature to block tunnel-related commands, allowing only minimal exceptions for utility functions (unset, echo, ping, and user). Restrict tunnel access to approved Microsoft Entra tenant IDs by specifying allowed tenants; all other users are denied access by default.