T1219.001 — IDE Tunneling

Tactic: Command and Control · Platforms: Linux, macOS, Windows

Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure…

Sub-technique of Remote Access Tools (T1219).

Sigma detection rules (3)

T1219.001 Remote Access Tools: IDE Tunneling

title: "T1219.001 Remote Access Tools: IDE Tunneling"
id: 971bc5ef-0ac6-42ba-8954-71f24827128e
description: 'Detects IDE/tunnel binaries (VS Code, code-tunnel, JetBrains) connecting on tunnel ports (443/22). (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, TunnelDomainPatterns, AuthorizedUserList.'
references:
  - https://attack.mitre.org/techniques/T1219/001
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.command-and-control
  - attack.t1219.001

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Image|endswith:
      - '\Code.exe'
      - '\Code - Insiders.exe'
      - '\code-tunnel.exe'
      - '\rider64.exe'
      - '\idea64.exe'
      - '\pycharm64.exe'
      - '\devenv.exe'
    DestinationPort:
      - 443
      - 22
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Legitimate VS Code Remote Tunnels/JetBrains Gateway use.

level: medium

T1219.001 Remote Access Tools: IDE Tunneling

title: "T1219.001 Remote Access Tools: IDE Tunneling"
id: 8bc164f3-6675-4aa7-ba21-42529f14f9fe
description: 'Detects IDE-native remote-tunnel establishment (VS Code `code tunnel`/`code --tunnel` CLI invocations, JetBrains Gateway/remote-dev-server thin-client launches) and creation of their local tunnel-session artifact files. Retargeted from generic ssh -R/-L/-D port-forwarding and third-party tunneling binaries (ngrok/chisel/frpc/gost), which describe Protocol Tunneling (T1572)/general C2 tunneling rather than IDE tunneling specifically. Tune using: TunnelCLIFlags, TunnelArtifactPath, Username.'
references:
  - https://attack.mitre.org/techniques/T1219/001
author: Shahrukh Khan
date: 2026-03-07
license: MIT
tags:
  - attack.command-and-control
  - attack.t1219.001

logsource:
  category: process_creation
  product: linux

detection:
  selection_vscode_tunnel:
    type: EXECVE
    a0|endswith:
      - '/code'
      - '/code-tunnel'
    a1|contains:
      - 'tunnel'
      - '--tunnel'
  selection_jetbrains_gateway:
    type: EXECVE
    a0|endswith:
      - '/remote-dev-server.sh'
      - '/jetbrains-gateway'
      - '/gateway.sh'
  selection_tunnel_artifact:
    type: PATH
    name|contains:
      - '.vscode/cli/code_tunnel.json'
      - '.cache/JetBrains'
    nametype: CREATE

  condition: 1 of selection*

falsepositives:
  - Developers legitimately using VS Code Remote Tunnels or JetBrains Gateway for approved remote development work; scope to unexpected accounts, off-hours use, or hosts with no prior remote-dev history.

level: high

T1219.001 Remote Access Tools: IDE Tunneling

title: "T1219.001 Remote Access Tools: IDE Tunneling"
id: 714badcd-f0ee-48a3-9c67-2b2b5b58496a
description: 'IDE Tunneling Detection via Process, File, and Network Behaviors. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentProcessName, RemoteTunnelPersistence, RemoteFlag, LaunchAgentPath, TunnelReconnectInterval.'
references:
  - https://attack.mitre.org/techniques/T1219/001
author: Shahrukh Khan
date: 2026-02-21
license: MIT
tags:
  - attack.command-and-control
  - attack.t1219.001

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|endswith:
      - '/ngrok'
      - '/frpc'
      - '/chisel'
      - '/localtunnel'
  selection_port:
    DestinationPort:
      - 443
      - 4443
      - 8443
  condition: selection and selection_port

falsepositives:
  - Developers legitimately use ngrok and similar tunneling utilities to expose local development servers, so alerting should focus on execution outside developer machines or launch via a LaunchAgent rather than an interactive terminal.

level: high

Related sub-techniques

Explore