Windows: cdb.exe Launched With Debugger Script Flags to Execute Commands

Alerts on cdb.exe starting with debugger script arguments that may be used to execute arbitrary commands.

FreeUnreviewedSigmamediumv1

windows-cdb-exe-launched-with-debugger-script-flags-to-execute-commands-b5c7395f

title: "Windows: cdb.exe Launched With Debugger Script Flags to Execute Commands"
id: 72763bd1-6e57-40ef-a2da-86779ccb8883
status: test
description: This rule flags process creation events where cdb.exe (or a binary matching its original file name) is executed with command-line arguments consistent with running a debugger script. Attackers can use this behavior to proxy execution and launch arbitrary commands indirectly through the debugger. It relies on Windows process creation telemetry capturing the process image path and the full command line, including the debugger script flags.
references:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/
  - https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html
  - https://twitter.com/nas_bench/status/1534957360032120833
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml
author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2019-10-26
modified: 2024-04-22
tags:
  - attack.execution
  - attack.stealth
  - attack.t1106
  - attack.t1218
  - attack.t1127
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cdb.exe
    - OriginalFileName: CDB.Exe
  selection_cli:
    CommandLine|contains:
      - " -c "
      - " -cf "
  condition: all of selection*
falsepositives:
  - Legitimate use of debugging tools
level: medium
license: DRL-1.1
related:
  - id: b5c7395f-e501-4a08-94d4-57fe7a9da9d2
    type: derived

What it detects

This rule flags process creation events where cdb.exe (or a binary matching its original file name) is executed with command-line arguments consistent with running a debugger script. Attackers can use this behavior to proxy execution and launch arbitrary commands indirectly through the debugger. It relies on Windows process creation telemetry capturing the process image path and the full command line, including the debugger script flags.

Known false positives

Legitimate use of debugging tools

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.