Java Running with Remote Debugging

Title: Java Running with Remote Debugging
Status: test
Description:Detects a JAVA process running with remote debugging allowing more than just localhost to connect
References:
  -https://dzone.com/articles/remote-debugging-java-applications-with-jdwp
Author: Florian Roth (Nextron Systems)
Date: 2019-01-16
modified:2023-02-01
Tags:

• -'attack.t1203'
• -'attack.execution'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_jdwp_transport:
    CommandLine|contains: 'transport=dt_socket,address='
  selection_old_jvm_version:
    CommandLine|contains:
      -'jre1.'
      -'jdk1.'

  exclusion:
    CommandLine|contains:
      -'address=127.0.0.1'
      -'address=localhost'

  condition:all of selection_* and not exclusion
Falsepositives:
  -Unknown
Level: medium