Windows Debugger Tool Execution

This rule detects the execution of common debugger tools (x32dbg, x64dbg, windbg) on Windows endpoints. While these tools have legitimate uses for software development and analysis, they are frequently abused by malware, such as PlugX and DarkGate, for malicious purposes like DLL side-loading or code injection. Detecting their presence and execution, especially in environments where they are not typically used by non-technical users, can indicate suspicious activity and potential compromise. This rule is designed to help Security Operations Centers (SOCs) identify such potentially malicious tool usage.