Cdb.exe

Commands

1. ExecuteUser T1127

   Local execution of assembly shellcode.

   cdb.exe -cf {PATH:.wds} -o notepad.exe

   Launch 64-bit shellcode from the specified .wds file using cdb.exe.

   os: Windows

   Execute: Shellcode

2. ExecuteUser T1127

   Run a shell command under a trusted Microsoft signed binary

   cdb.exe -pd -pn {process_name}
   .shell {CMD}
   

   Attaching to any process and executing shell commands.

   os: Windows

   Execute: CMD

3. ExecuteUser T1127

   Run commands under a trusted Microsoft signed binary

   cdb.exe -c {PATH:.txt} "{CMD}"

   Execute arbitrary commands and binaries using a debugging script (see Resources section for a sample file).

   os: Windows

   Execute: CMD

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_cdb.yml
• Elastic https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml
• Elastic https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml
• BlockRule https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

Code samples

• https://gist.github.com/nasbench/d9c15864f1e21bdd8b7cf55997b45f4b

Resources

• http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html
• https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/cdb-command-line-options
• https://gist.github.com/mattifestation/94e2b0a9e3fe1ac0a433b5c3e6bd0bda
• https://mrd0x.com/the-power-of-cdb-debugging-tool/
• https://twitter.com/nas_bench/status/1534957360032120833