Java Running with Remote Debugging

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a JAVA process running with remote debugging allowing more than just localhost to connect

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1203` Exploitation for Client Execution

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Java Running with Remote Debugging
id: 8f88e3f6-2a49-48f5-a5c4-2f7eedf78710
status: test
description: Detects a JAVA process running with remote debugging allowing more than just localhost to connect
references:
    - https://dzone.com/articles/remote-debugging-java-applications-with-jdwp
author: Florian Roth (Nextron Systems)
date: 2019-01-16
modified: 2023-02-01
tags:
    - attack.t1203
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_jdwp_transport:
        CommandLine|contains: 'transport=dt_socket,address='
    selection_old_jvm_version:
        CommandLine|contains:
            - 'jre1.'
            - 'jdk1.'
    exclusion:
        CommandLine|contains:
            - 'address=127.0.0.1'
            - 'address=localhost'
    condition: all of selection_* and not exclusion
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_* and not exclusion

Stage 1: `selection_jdwp_transport`

selection_jdwp_transport:
    CommandLine|contains: 'transport=dt_socket,address='

Stage 2: `selection_old_jvm_version`

selection_old_jvm_version:
    CommandLine|contains:
        - 'jre1.'
        - 'jdk1.'

Stage 3: `not exclusion`

exclusion:
    CommandLine|contains:
        - 'address=127.0.0.1'
        - 'address=localhost'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`address=127.0.0.1`	`excludes:CommandLine` `field:"CommandLine" value:"address=127.0.0.1"`
`CommandLine`	match	`address=localhost`	`excludes:CommandLine` `field:"CommandLine" value:"address=localhost"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`jdk1.` `jre1.` `transport=dt_socket,address=`	`field:"CommandLine" kind:match`

Java Running with Remote Debugging

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_jdwp_transport

Stage 2: selection_old_jvm_version

Stage 3: not exclusion

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection_jdwp_transport`

Stage 2: `selection_old_jvm_version`

Stage 3: `not exclusion`