Suspicious Add Debugger Entry To AeDebug For Persistence (via registry_set)

title: Suspicious Add Debugger Entry To AeDebug For Persistence (via registry_set)
id: 789ecc2a-bb4f-5f83-9fbe-93dd5782dbb0
status: stable
description: This rule detects when an adversary adds a new "Debugger" value to the "AeDebug" key to achieve persistence which will get invoked when an application crashes
references:
    - https://persistence-info.github.io/Data/aedebug.html
    - https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging
author: Huntrule Team
date: 2026-01-08
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1546.012
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger'
        Details|endswith: '.dll'
    filter:
        Details: '"C:\WINDOWS\system32\vsjitdebugger.exe" -p %ld -e %ld -j 0x%p'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium