Windows Registry: Add Debugger value under AeDebug for crash-time execution persistence
Flags registry writes that set an AeDebug Debugger .dll value, enabling debugger execution on application crashes.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule identifies when a new registry entry is set under AeDebug specifically targeting the Debugger value, where the data ends with .dll. Attackers abuse AeDebug to have a chosen debugger invoked automatically when an application crashes, enabling persistence and execution under the context of the crash-handling flow. The detection relies on Windows registry set telemetry capturing writes to the specified AeDebug Debugger path and the stored value ending pattern, excluding a known vsjitdebugger-based command-line configuration.
Reporting behind it
- persistence-info.github.iohttps://persistence-info.github.io/Data/aedebug.html
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_aedebug_persistence.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Add Debugger value under AeDebug for crash-time execution persistence"
id: da2fd1ed-fa41-47fa-8606-3b73fc273675
status: test
description: This rule identifies when a new registry entry is set under AeDebug specifically targeting the Debugger value, where the data ends with .dll. Attackers abuse AeDebug to have a chosen debugger invoked automatically when an application crashes, enabling persistence and execution under the context of the crash-handling flow. The detection relies on Windows registry set telemetry capturing writes to the specified AeDebug Debugger path and the stored value ending pattern, excluding a known vsjitdebugger-based command-line configuration.
references:
- https://persistence-info.github.io/Data/aedebug.html
- https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_aedebug_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger
Details|endswith: .dll
filter:
Details: '"C:\WINDOWS\system32\vsjitdebugger.exe" -p %ld -e %ld -j 0x%p'
condition: selection and not filter
falsepositives:
- Legitimate use of the key to setup a debugger. Which is often the case on developers machines
level: medium
license: DRL-1.1
related:
- id: 092af964-4233-4373-b4ba-d86ea2890288
type: derived