Windows Java Process Launched with JDWP Remote Debugging Bound Beyond Localhost

title: Windows Java Process Launched with JDWP Remote Debugging Bound Beyond Localhost
id: b41bd4f2-dfb8-468b-9210-1e86937ecbac
status: test
description: This rule flags Windows process creation events where a Java command line includes JDWP remote debugging transport settings (dt_socket,address=), indicating the debug interface is configured for network access. Remote debugging exposed beyond localhost can allow attackers to attach to the JVM and potentially inspect or manipulate execution. The detection relies on process creation command-line telemetry containing JDWP parameters and excludes cases where the bound address is only localhost or 127.0.0.1.
references:
  - https://dzone.com/articles/remote-debugging-java-applications-with-jdwp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_remote_debugging.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-01-16
modified: 2023-02-01
tags:
  - attack.t1203
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_jdwp_transport:
    CommandLine|contains: transport=dt_socket,address=
  selection_old_jvm_version:
    CommandLine|contains:
      - jre1.
      - jdk1.
  exclusion:
    CommandLine|contains:
      - address=127.0.0.1
      - address=localhost
  condition: all of selection_* and not exclusion
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 8f88e3f6-2a49-48f5-a5c4-2f7eedf78710
    type: derived