rules/windows/sysmon/sysmon_vul_java_remote_debugging.yml

title: Java Running with Remote Debugging
description: Detects a JAVA process running with remote debugging allowing more than just localhost to connect
author: Florian Roth
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        CommandLine: '*transport=dt_socket,address=*'
    exclusion:
        - CommandLine: '*address=127.0.0.1*'
        - CommandLine: '*address=localhost*'
    condition: selection and not exclusion
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - unknown
level: medium
Massive Title Cleanup 2018-01-27 10:57:30 +01:00			`title: Java Running with Remote Debugging`
fixed typo 2018-07-16 16:20:33 -05:00			`description: Detects a JAVA process running with remote debugging allowing more than just localhost to connect`
Added "logsource" sections and new rule 2017-02-19 00:31:59 +01:00			`author: Florian Roth`
			`logsource:`
Sysmon as 'service' of product 'windows' 2017-03-13 09:23:08 +01:00			`product: windows`
			`service: sysmon`
Rew rule examples: RC4 Kerberos, JAVA remote debugging process 2017-02-06 20:03:42 +01:00			`detection:`
			`selection:`
Rule review and cleanup 2017-02-15 23:53:08 +01:00			`EventID: 1`
			`CommandLine: 'transport=dt_socket,address='`
Rew rule examples: RC4 Kerberos, JAVA remote debugging process 2017-02-06 20:03:42 +01:00			`exclusion:`
			`- CommandLine: 'address=127.0.0.1'`
			`- CommandLine: 'address=localhost'`
			`condition: selection and not exclusion`
Added field names to first rules 2017-09-12 23:54:04 +02:00			`fields:`
			`- CommandLine`
			`- ParentCommandLine`
Rew rule examples: RC4 Kerberos, JAVA remote debugging process 2017-02-06 20:03:42 +01:00			`falsepositives:`
			`- unknown`
Levels to low, medium, high, critical 2017-02-16 18:02:26 +01:00			`level: medium`