Java Remote Debugging Enabled Externally

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the creation of a Java process that is configured for remote debugging, specifically when the debugging interface is bound to an address other than localhost (127.0.0.1 or localhost). This configuration allows external connections to the Java Debug Wire Protocol (JDWP) port, which can be exploited by attackers to gain control over the Java application or the underlying system. The rule looks for the 'transport=dt_socket,address=' string in the command line, combined with the absence of 'address=127.0.0.1' or 'address=localhost'. It also includes a check for older JVM versions ('jre1.' or 'jdk1.') which might be more vulnerable.