Skip to content
Threat Feed
Subscribe

Tag

Remote-Access-Tools

2 briefs RSS
medium advisory

Detection of VScode Remote Tunneling for Command and Control

The rule detects the execution of the VScode portable binary with the tunnel command line option, potentially indicating an attempt to establish a remote tunnel session to Github or a remote VScode instance for unauthorized access and command and control.

Microsoft Defender XDR +3 command-and-control vscode remote-access-tools windows
2r 1t
medium advisory

Multiple Remote Management Tool Vendors on Same Host

The presence of multiple remote monitoring and management (RMM) tools from different vendors on a single Windows host within a short time frame may indicate compromise, shadow IT, or attacker staging for redundant access.

TeamViewer +3 remote-access-tools command-and-control windows
3r