Windows Registry: Add Debugger value under AeDebug for crash-time execution persistence

Flags registry writes that set an AeDebug Debugger .dll value, enabling debugger execution on application crashes.

FreeUnreviewedSigmamediumv1

windows-registry-add-debugger-value-under-aedebug-for-crash-time-execution-persi-092af964

title: "Windows Registry: Add Debugger value under AeDebug for crash-time execution persistence"
id: da2fd1ed-fa41-47fa-8606-3b73fc273675
status: test
description: This rule identifies when a new registry entry is set under AeDebug specifically targeting the Debugger value, where the data ends with .dll. Attackers abuse AeDebug to have a chosen debugger invoked automatically when an application crashes, enabling persistence and execution under the context of the crash-handling flow. The detection relies on Windows registry set telemetry capturing writes to the specified AeDebug Debugger path and the stored value ending pattern, excluding a known vsjitdebugger-based command-line configuration.
references:
  - https://persistence-info.github.io/Data/aedebug.html
  - https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_aedebug_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger
    Details|endswith: .dll
  filter:
    Details: '"C:\WINDOWS\system32\vsjitdebugger.exe" -p %ld -e %ld -j 0x%p'
  condition: selection and not filter
falsepositives:
  - Legitimate use of the key to setup a debugger. Which is often the case on developers machines
level: medium
license: DRL-1.1
related:
  - id: 092af964-4233-4373-b4ba-d86ea2890288
    type: derived

What it detects

This rule identifies when a new registry entry is set under AeDebug specifically targeting the Debugger value, where the data ends with .dll. Attackers abuse AeDebug to have a chosen debugger invoked automatically when an application crashes, enabling persistence and execution under the context of the crash-handling flow. The detection relies on Windows registry set telemetry capturing writes to the specified AeDebug Debugger path and the stored value ending pattern, excluding a known vsjitdebugger-based command-line configuration.

Known false positives

Legitimate use of the key to setup a debugger. Which is often the case on developers machines

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.