Add DbgSrv.exe trusted developer utility proxy execution

[PhyoPaingHtun]

Summary

This pull request adds DbgSrv.exe as a new LOLBAS entry under:

yml/OtherMSBinaries/DbgSrv.yml

DbgSrv.exe is the Microsoft-signed process server included with
Debugging Tools for Windows. It is installed through Microsoft's Windows
SDK/WDK debugging-tools package and is not normally present on a default
Windows installation.

The proposed entry documents the ability of DbgSrv.exe to:

1. Create an arbitrary process through the documented -c option.
2. Act as a trusted Microsoft-signed execution proxy.
3. Expose a debugging transport that can support remote debugging.
4. Establish a reverse debugging connection through the documented
   clicon= transport option.

The primary behavior reproduced in my lab was:

dbgsrv.exe -t tcp:port=5005 -c {CMD}

[PhyoPaingHtun]

Evidence attached simulation

The following validation materials are attached to or referenced by this
pull request:

Full simulation video:
https://github.com/user-attachments/assets/ff08bc79-4cca-4bf8-b659-7025a99c443f

PowerShell validation script:
Invoke-DbgSrvLolbas.zip

Evidence archive:
01-authenticode.txt
02-sha256.txt
03-version.txt
04-process-tree.txt
05-network.txt
06-result.txt

The PowerShell simulation performs the following checks:

• Searches only expected Windows Kits debugger locations.
• Stops if DbgSrv.exe cannot be located.
• Verifies that the Authenticode status is valid.
• Verifies that the signer certificate belongs to Microsoft.
• Records the binary SHA-256 and version metadata.
• Confirms that the selected TCP port is available.
• Starts DbgSrv with a harmless child command.
• Records the DbgSrv and child-process command lines.
• Records the TCP endpoint owned by DbgSrv.
• Verifies marker-file creation.
• Terminates the test processes.
• Preserves the evidence files for review.

[PhyoPaingHtun]

Additional public research context

In addition to the lab simulation provided above, Red Canary documented the security relevance of dbgsrv.exe during the Black Hat 2019 presentation “Fantastic Red Team Attacks and How to Find Them.”

In the controlled red-team exercise, Casey Smith used the trusted, Microsoft-signed dbgsrv.exe process server to establish an outbound reverse debugging connection using the clicon= option. After the remote debugging channel was established, Meterpreter shellcode was injected into notepad.exe, resulting in remote access to the simulated developer workstation. Red Canary described this technique as providing capabilities comparable to reverse TCP connectivity, process hollowing, and application-whitelist evasion through legitimate remote-debugging functionality.

The research also showed valuable detection opportunities, including:

• dbgsrv.exe executed with clicon=.
• An outbound network connection from dbgsrv.exe.
• dbgsrv.exe launched from an unusual parent such as explorer.exe.
• A normally network-inactive process such as notepad.exe making an external connection.
• Correlation between the DbgSrv destination and the destination used by the subsequently manipulated process.

This was a controlled red-team simulation, not a reported real-world criminal intrusion. My submitted simulation validates only the benign DbgSrv.exe -c process-creation behavior and does not claim to reproduce Meterpreter, shellcode injection, process hollowing, or an external callback.

Red Canary research:
https://redcanary.com/blog/threat-detection/black-hat-detecting-the-unknown-and-disclosing-a-new-attack-technique/

Microsoft reverse process-server documentation:
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/activating-a-process-server