306. Adversaries Modify Registry to Enable Remote Debugging
Hello everyone! I'm sure you know that adversaries abuse remote debugging feature to extract cookies from web-browsers. Today we'll look how threat actors modify registry to enable this feature. If you look through this report , you'll notice that the adversary abused reg.exe to modify registry and allow remote debugging: reg.exe add HKEY_CURRENT_USER\Software\Policies\Google\Chrome /v RemoteDebuggingAllowed /t REG_DWORD /d 1 /f For example, we can hunt for reg.exe abuse: event_type: "processcreatewin" AND proc_file_path: "reg.exe" AND cmdline: "RemoteDebuggingAllowed" Or you can focus on registry modification: event_type: "registryvaluesetwin" AND reg_key_path: "RemoteDebuggingAllowed" See you tomorrow!