Windows Registry Persistence: DbgManagedDebugger Debugger Value Added

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574Hijack Execution Flow
Persistence
- T1574Hijack Execution Flow
Priv Esc
- T1574Hijack Execution Flow
Defense Evasion
- T1574Hijack Execution Flow
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags when a Windows registry value named "Debugger" is set under the \Microsoft\.NETFramework\DbgManagedDebugger key. Adding this entry can create application-crash-triggered code execution, which attackers may leverage for persistence or stealth. The detection relies on registry set telemetry that records the targeted registry path and associated value information, and excludes entries matching a specific vsjitdebugger.exe debug configuration pattern.

Reporting behind it

Related detections8 linkedT1574 — drag to rearrange

Suspicious LD_PRELOAD Library Injection via PUMAKIT Userland Rootkit

Windows DLL Search Order Hijacking: Suspicious DLL Writes to App Dependency Folders

Windows Suspicious DLL Deletion in Spooler Driver Folder (PrintNightmare/CVE-2021-1675)

Windows ImageLoad of DLL from spoolsv.exe spool drivers subfolders

Windows DLL execution via register-cimprovider.exe with -path dll

Windows Registry Printer Driver Installations with Empty Manufacturer Field

Windows Process Creation: Suspicious SetupComplete.cmd execution for CVE-2019-1378 exploitation

Windows regsvr32 Executes DLL with Uncommon Extension in Command Line

Windows Registry Persistence: DbgManagedDebugger Debugger Value Added

Pivot detection · T1574 · 8 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-registry-persistence-dbgmanageddebugger-debugger-value-added-9827ae57

title: "Windows Registry Persistence: DbgManagedDebugger Debugger Value Added"
id: 59978f15-b3a5-451f-a57b-105873098159
status: test
description: This rule flags when a Windows registry value named "Debugger" is set under the \Microsoft\.NETFramework\DbgManagedDebugger key. Adding this entry can create application-crash-triggered code execution, which attackers may leverage for persistence or stealth. The detection relies on registry set telemetry that records the targeted registry path and associated value information, and excludes entries matching a specific vsjitdebugger.exe debug configuration pattern.
references:
  - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
  - https://github.com/last-byte/PersistenceSniper
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_dbgmanageddebugger_persistence.yml
author: frack113, Huntrule Team
date: 2022-08-07
modified: 2023-08-17
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Microsoft\.NETFramework\DbgManagedDebugger
  filter:
    Details: '"C:\Windows\system32\vsjitdebugger.exe" PID %d APPDOM %d EXTEXT "%s" EVTHDL %d'
  condition: selection and not filter
falsepositives:
  - Legitimate use of the key to setup a debugger. Which is often the case on developers machines
level: medium
license: DRL-1.1
related:
  - id: 9827ae57-3802-418f-994b-d5ecf5cd974b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL