.. /devtunnel.exe
Star

Binary to enable forwarded ports on windows operating systems.

Paths:

C:\Users\\AppData\Local\Temp\.net\devtunnel\
C:\Users\\AppData\Local\Temp\DevTunnels

Resources:

https://code.visualstudio.com/docs/editor/port-forwarding

Acknowledgements:

Kamran Saifullah (@deFr0ggy)

Detection:

IOC: devtunnel.exe binary spawned
IOC: *.devtunnels.ms
IOC: *.*.devtunnels.ms
Analysis: https://cydefops.com/vscode-data-exfiltration

Download

Enabling a forwarded port for locally hosted service at port 8080 to be exposed on the internet.
```
devtunnel.exe host -p 8080
```
Use case
Download Files, Upload Files, Data Exfiltration

Privileges required
User

Operating systems
Windows 10, Windows 11, MacOS

ATT&CK® technique
T1105