DebugData Check

Hunt Hypothesis

This rule identifies anomalous debug data artifacts that may indicate an adversary is using debugging tools to inspect or manipulate application state during execution. Proactively hunting for these indicators helps the SOC detect stealthy reconnaissance or exploitation attempts that leverage debug features to bypass standard security controls within Azure Sentinel.

YARA Rule

rule HasDebugData : PECheck
{
	meta: 
		author = "_pusher_"
		description = "DebugData Check"
		date="2016-07"
	condition:
		// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		//orginal
		//((uint32(uint32(0x3C)+0xA8) >0x0) and (uint32be(uint32(0x3C)+0xAC) >0x0))
		//((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) x64/x32
		(IsPE32 or IsPE64) and
		((uint32(uint32(0x3C)+0xA8+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5)) >0x0) and (uint32be(uint32(0x3C)+0xAC+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5)) >0x0))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

• Scenario: Development teams using Visual Studio or JetBrains Rider to attach to local or remote processes for debugging, which often involves writing temporary debug metadata or triggering specific API calls associated with debug symbols.
  • Filter/Exclusion: Exclude source processes named devenv.exe, dotnet.exe, java.exe, or idea64.exe (or their respective parent processes) when the target path contains /bin/Debug/ or /obj/Debug/.
• Scenario: Automated CI/CD pipelines (e.g., Jenkins, Azure DevOps, GitHub Actions) executing build steps that include dotnet build -c Debug or npm run build:debug, which may generate temporary debug artifacts or invoke debug-specific compiler flags.
  • Filter/Exclusion: Exclude events where the parent process is a known CI/CD agent binary (e.g., agent.exe, jenkins-agent.jar, runner.exe) or where the command line contains arguments like -c Debug, --debug, or NODE_ENV=development.
• Scenario: Application performance monitoring (APM) agents (e.g., Dynatrace, AppDynamics, New Relic) or diagnostic tools (e.g., Wireshark, PerfView) attaching to application processes to capture trace data or heap dumps, which can mimic debug data generation.
  • Filter/Exclusion: Exclude source processes corresponding to known APM agents (e.g., dtagent.exe, appdynamics_agent.exe, newrelic-agent.exe) or diagnostic utilities (e.g., wireshark.exe, perfview.exe) when the target is a standard application service.
• Scenario: Scheduled maintenance jobs or health check scripts (e.g., PowerShell scripts run via Task Scheduler or Cron) that explicitly enable verbose logging or debug modes for troubleshooting purposes during off-hours maintenance windows.