Potential Registry Persistence via DbgManagedDebugger

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects attempts to establish persistence by modifying the "DbgManagedDebugger" registry key within the .NET Framework hive. Adversaries can leverage this mechanism to execute a debugger or any specified executable when a .NET application crashes, effectively achieving persistence or privilege escalation. The rule specifically looks for modifications to the 'Debugger' value under the 'Microsoft\.NETFramework\DbgManagedDebugger' key, while filtering out legitimate modifications made by 'vsjitdebugger.exe'.