Umbrij port-check command-line arguments (-debugport/-lport)

Duo Tech@duotech

•updated Jul 6, 2026•1•0•3

Detects the execution of processes containing command-line arguments '-debugport' or '-lport'. These flags are often used to configure remote debugging or listen ports, which can be abused by adversaries for persistence or command and control (C2) communication.