.. /Cdb.exe
Star

Execute

Debugging tool included with Windows Debugging Tools.


Paths:

Resources:
Acknowledgements:

Detection:

Execute

  1. Launch 64-bit shellcode from the x64_calc.wds file using cdb.exe.

    cdb.exe -cf x64_calc.wds -o notepad.exe
    Use case
    Local execution of assembly shellcode.
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1127

  2. Attaching to any process and executing shell commands.

    cdb.exe -pd -pn <process_name>
.shell <cmd>
    Use case
    Run a shell command under a trusted Microsoft signed binary
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1127

  3. Execute arbitrary commands and binaries using a debugging script (see Resources section for a sample file).

    cdb.exe -c C:\debug-script.txt calc
    Use case
    Run commands under a trusted Microsoft signed binary
    Privileges required
    User
    Operating systems
    Windows
    ATT&CK® technique
    T1127