Windows Java Process Started with Remote Debugging Enabled for Non-Localhost Connections

Identifies Java processes started with JDWP dt_socket remote debugging on a non-localhost address.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-01-16
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1203Exploitation for Client Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process creation events where a Java command line includes JDWP remote debugging settings (transport=dt_socket,address=) and does not restrict connections to localhost. Allowing remote debugging beyond 127.0.0.1 or localhost can expose an interactive debugging interface that attackers may leverage for inspection or control. The detection relies on process creation command-line telemetry, matching the presence of JDWP parameters while excluding common local-only address configurations.

Reporting behind it

Related detections9 linkedT1203 — drag to rearrange

Suspicious Child Process Spawned by WinRAR via Process Creation

Malicious Script Execution from WinRAR Extraction Directory via CVE-2023-38831

Suspicious Execution From WinRAR Temporary Extraction Path via Command Line (via process_creation)

Malicious Shell Execution via Foomatic-rip Print Filter through CUPS Exploit

Suspicious Network Connection From CUPS Foomatic-Rip Child Process

Antivirus signatures matching APT malware naming patterns

Antivirus Remote Access Tool Signature Matches Known RAT Names

Malicious Microsoft Word Spawning Anomalous Child Process via CVE-2023-36884 (via process_creation)

Possible ExifTool CVE-2026-3102 Command Injection via Child Process Spawn (via process_creation)

Windows Java Process Started with Remote Debugging Enabled for Non-Localhost Connections

Pivot detection · T1203 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-java-process-launched-with-jdwp-remote-debugging-bound-beyond-localhost-8f88e3f6

title: Windows Java Process Started with Remote Debugging Enabled for Non-Localhost Connections
id: b41bd4f2-dfb8-468b-9210-1e86937ecbac
status: test
description: This rule identifies Windows process creation events where a Java command line includes JDWP remote debugging settings (transport=dt_socket,address=) and does not restrict connections to localhost. Allowing remote debugging beyond 127.0.0.1 or localhost can expose an interactive debugging interface that attackers may leverage for inspection or control. The detection relies on process creation command-line telemetry, matching the presence of JDWP parameters while excluding common local-only address configurations.
references:
  - https://dzone.com/articles/remote-debugging-java-applications-with-jdwp
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_java_remote_debugging.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-01-16
modified: 2023-02-01
tags:
  - attack.t1203
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_jdwp_transport:
    CommandLine|contains: transport=dt_socket,address=
  selection_old_jvm_version:
    CommandLine|contains:
      - jre1.
      - jdk1.
  exclusion:
    CommandLine|contains:
      - address=127.0.0.1
      - address=localhost
  condition: all of selection_* and not exclusion
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 8f88e3f6-2a49-48f5-a5c4-2f7eedf78710
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL