Windows Browser Started with Remote Debugging Flags

title: Windows Browser Started with Remote Debugging Flags
id: a3618bea-dafa-40a8-91d2-f173cb490e34
related:
  - id: 3e8207c5-fcd2-4ea6-9418-15d45b4890e4
    type: derived
  - id: b3d34dc5-2efd-4ae3-845f-8ec14921f449
    type: derived
status: test
description: This rule flags process creation events where a Chromium-based browser is launched with remote debugging command-line options or where Firefox is started with the debugger server switch. Remote debugging features can be abused to manipulate browser state and potentially facilitate injection or session access attacks. It relies on Windows process creation telemetry, specifically the process image name and command-line arguments containing the remote debugging indicators.
references:
  - https://yoroi.company/wp-content/uploads/2022/05/EternityGroup_report_compressed.pdf
  - https://www.mdsec.co.uk/2022/10/analysing-lastpass-part-1/
  - https://github.com/defaultnamehere/cookie_crimes/
  - https://github.com/wunderwuzzi23/firefox-cookiemonster
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_browsers_remote_debugging.yml
author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-27
modified: 2022-12-23
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1185
logsource:
  category: process_creation
  product: windows
detection:
  selection_chromium_based:
    CommandLine|contains: " --remote-debugging-"
  selection_firefox:
    Image|endswith: \firefox.exe
    CommandLine|contains: " -start-debugger-server"
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1