All Detections

Jewelbug Renamed cdb.exe Execution

avatar
Tim Peck@timpeck
updated Oct 15, 2025050

Detects the execution of a renamed Microsoft Console Debugger (cdb.exe), a technique observed being used by the Jewelbug APT group for defense evasion and execution.

YARA-L