blue-team-tools/rules/windows/sysmon/sysmon_vul_java_remote_debugging.yml

title: Java running with Remote Debugging
description: Detcts a JAVA process running with remote debugging allowing more than just localhost to connect
detection:
    selection:
        - EventLog: Microsoft-Windows-Sysmon/Operational
        - EventID: 1
        - CommandLine: '*transport=dt_socket,address=*'
    exclusion:
        - CommandLine: '*address=127.0.0.1*'
        - CommandLine: '*address=localhost*'
    condition: selection and not exclusion
falsepositives:
    - unknown
level: 30