rules/windows/sysmon/sysmon_vul_java_remote_debugging.yml

title: Java running with Remote Debugging
description: Detcts a JAVA process running with remote debugging allowing more than just localhost to connect
author: Florian Roth
logsource:
    product: sysmon
detection:
    selection:
        EventLog: Microsoft-Windows-Sysmon/Operational
        EventID: 1
        CommandLine: '*transport=dt_socket,address=*'
    exclusion:
        - CommandLine: '*address=127.0.0.1*'
        - CommandLine: '*address=localhost*'
    condition: selection and not exclusion
falsepositives:
    - unknown
level: medium
Rew rule examples: RC4 Kerberos, JAVA remote debugging process 2017-02-06 20:03:42 +01:00			`title: Java running with Remote Debugging`
Renamed rule files, new rules 2017-02-10 19:17:02 +01:00			`description: Detcts a JAVA process running with remote debugging allowing more than just localhost to connect`
Added "logsource" sections and new rule 2017-02-19 00:31:59 +01:00			`author: Florian Roth`
			`logsource:`
Removed lists from log source section 2017-02-19 11:08:23 +01:00			`product: sysmon`
Rew rule examples: RC4 Kerberos, JAVA remote debugging process 2017-02-06 20:03:42 +01:00			`detection:`
			`selection:`
Rule review and cleanup 2017-02-15 23:53:08 +01:00			`EventLog: Microsoft-Windows-Sysmon/Operational`
			`EventID: 1`
			`CommandLine: 'transport=dt_socket,address='`
Rew rule examples: RC4 Kerberos, JAVA remote debugging process 2017-02-06 20:03:42 +01:00			`exclusion:`
			`- CommandLine: 'address=127.0.0.1'`
			`- CommandLine: 'address=localhost'`
			`condition: selection and not exclusion`
			`falsepositives:`
			`- unknown`
Levels to low, medium, high, critical 2017-02-16 18:02:26 +01:00			`level: medium`