Binary to enable forwarded ports on windows operating systems.
devtunnel.exe host -p 8080
Enabling a forwarded port for locally hosted service at port 8080 to be exposed on the internet.
Download Files, Upload Files, Data Exfiltration
C:\Users\<username>\AppData\Local\Temp\.net\devtunnel\, C:\Users\<username>\AppData\Local\Temp\DevTunnels
IOC: devtunnel.exe binary spawned, IOC: *.devtunnels.ms, IOC: *.*.devtunnels.ms, Analysis: https://cydefops.com/vscode-data-exfiltration
Kamran Saifullah (@deFr0ggy)