Debugging tool included with Windows Debugging Tools.
cdb.exe -cf x64_calc.wds -o notepad.exe
Launch 64-bit shellcode from the x64_calc.wds file using cdb.exe.
Local execution of assembly shellcode.
C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe, C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\cdb.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_cdb.yml, Elastic: https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_unusual_process_network_connection.toml, Elastic: https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_network_connection_from_windows_binary.toml, BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
Matt Graeber (@mattifestation), mr.d0x (@mrd0x), Spooky Sec (@sec_spooky), Nasreddine Bencherchali (@nas_bench)