Potential Registry Persistence Attempt Via DbgManagedDebugger

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes

Known false positives

Legitimate use of the key to setup a debugger. Which is often the case on developers machines

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1574` Hijack Execution Flow
Stealth	`T1574` Hijack Execution Flow

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Potential Registry Persistence Attempt Via DbgManagedDebugger
id: 9827ae57-3802-418f-994b-d5ecf5cd974b
status: test
description: Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes
references:
    - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
    - https://github.com/last-byte/PersistenceSniper
author: frack113
date: 2022-08-07
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Microsoft\.NETFramework\DbgManagedDebugger'
    filter:
        Details: '"C:\Windows\system32\vsjitdebugger.exe" PID %d APPDOM %d EXTEXT "%s" EVTHDL %d'
    condition: selection and not filter
falsepositives:
    - Legitimate use of the key to setup a debugger. Which is often the case on developers machines
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    TargetObject|endswith: '\Microsoft\.NETFramework\DbgManagedDebugger'

Stage 2: `not filter`

filter:
    Details: '"C:\Windows\system32\vsjitdebugger.exe" PID %d APPDOM %d EXTEXT "%s" EVTHDL %d'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Details`	eq	`"C:\Windows\system32\vsjitdebugger.exe" PID %d APPDOM %d EXTEXT "%s" EVTHDL %d`	`excludes:Details`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	ends_with	`\Microsoft\.NETFramework\DbgManagedDebugger`	`field:"TargetObject" kind:ends_with value:"\Microsoft\.NETFramework\DbgManagedDebugger"`