Execution via Windows Command Line Debugging Utility

[rule]
description = """
Identifies the execution of Microsoft Windows Debugging utility cdb.exe to execute shellcode or commands and from non
standard installation paths. This may indicate an attempt to evade defenses using trusted binaries.
"""
id = "57710bb9-a8d3-41ca-9b50-0f6765e9c2d7"
license = "Elastic License v2"
name = "Execution via Windows Command Line Debugging Utility"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/"]
version = "1.0.4"

query = '''
process where event.action == "start" and
 (process.pe.original_file_name == "CDB.Exe" or process.name : "cdb.exe") and
  process.code_signature.subject_name == "Microsoft Corporation"  and
  process.args : ("-cf", "-c", "-pd") and
  not process.executable : ("C:\\Program Files (x86)\\*.exe", "C:\\Program Files\\*.exe") and
  not process.parent.executable : "C:\\Windows\\SysWOW64\\WerFault.exe" and
  not process.args : "!Analyze -show; dqs esp; dqs; dqs; dqs; dqs; dqs; dqs; dqs; dqs; dqs; q"
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"