Potential Binary Proxy Execution Via Cdb.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

Detects the use of 'cdb.exe', a legitimate Windows debugger, to execute arbitrary processes or commands. This technique is often used by adversaries to bypass application whitelisting or execute malicious code through a trusted binary. The rule specifically looks for command-line arguments indicative of debugger script execution ('-c' or '-cf').