{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1622","id":"T1622","name":"Debugger Evasion","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1622","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"d13fdbd075a7701e89f2ecacd2e85b8d0dce610c2b7de13941ed4275864f9ca6","description":"Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.(Citation: ProcessHacker Github)\n\nDebugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment. Similar to [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497), if the adversary detects a debugger, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for debugger artifacts before dropping secondary or additional payloads.\n\nSpecific checks will vary based on the target and/or adversary. On Windows, this may involve [Native API](https://attack.mitre.org/techniques/T1106) function calls such as <code>IsDebuggerPresent()</code> and <code> NtQueryInformationProcess()</code>, or manually checking the <code>BeingDebugged</code> flag of the Process Environment Block (PEB). On Linux, this may involve querying `/proc/self/status` for the `TracerPID` field, which indicates whether or not the process is being traced by dynamic analysis tools.(Citation: Cado Security P2PInfect 2023)(Citation: Positive Technologies Hellhounds 2023) Other checks for debugging artifacts may also seek to enumerate hardware breakpoints, interrupt assembly opcodes, time checks, or measurements if exceptions are raised in the current process (assuming a present debugger would “swallow” or handle the potential error).(Citation: hasherezade debug)(Citation: AlKhaser Debug)(Citation: vxunderground debug)\n\nMalware may also leverage Structured Exception Handling (SEH) to detect debuggers by throwing an exception and detecting whether the process is suspended. SEH handles both hardware and software expectations, providing control over the exceptions including support for debugging. If a debugger is present, the program’s control will be transferred to the debugger, and the execution of the code will be suspended. If the debugger is not present, control will be transferred to the SEH handler, which will automatically handle the exception and allow the program’s execution to continue.(Citation: Apriorit)\n\nAdversaries may use the information learned from these debugger checks during automated discovery to shape follow-on behaviors. Debuggers can also be evaded by detaching the process or flooding debug logs with meaningless data via messages produced by looping [Native API](https://attack.mitre.org/techniques/T1106) function calls such as <code>OutputDebugStringW()</code>.(Citation: wardle evilquest partii)(Citation: Checkpoint Dridex Jan 2021)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1622","external_id":"T1622"},{"source_name":"Apriorit","description":"Apriorit. (2024, June 4). Anti Debugging Protection Techniques with Examples. Retrieved March 4, 2025.","url":"https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software"},{"source_name":"Checkpoint Dridex Jan 2021","description":"Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.","url":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"},{"source_name":"hasherezade debug","description":"hasherezade. (2021, June 30). Module 3 - Understanding and countering malware's evasion and self-defence. Retrieved April 1, 2022.","url":"https://github.com/hasherezade/malware_training_vol1/blob/main/slides/module3/Module3_2_fingerprinting.pdf"},{"source_name":"Cado Security P2PInfect 2023","description":"jbowen. (2023, December 4). P2Pinfect - New Variant Targets MIPS Devices. Retrieved March 18, 2025.","url":"https://www.cadosecurity.com/blog/p2pinfect-new-variant-targets-mips-devices"},{"source_name":"AlKhaser Debug","description":"Noteworthy. (2019, January 6). Al-Khaser. Retrieved April 1, 2022.","url":"https://github.com/LordNoteworthy/al-khaser/tree/master/al-khaser/AntiDebug"},{"source_name":"wardle evilquest partii","description":"Patrick Wardle. (2020, July 3). OSX.EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021.","url":"https://objective-see.com/blog/blog_0x60.html"},{"source_name":"ProcessHacker Github","description":"ProcessHacker. (2009, October 27). Process Hacker. Retrieved April 11, 2022.","url":"https://github.com/processhacker/processhacker"},{"source_name":"Positive Technologies Hellhounds 2023","description":"PT Expert Security Center. (2023, November 29). Hellhounds: operation Lahat. Retrieved March 18, 2025.","url":"https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/hellhounds-operation-lahat"},{"source_name":"vxunderground debug","description":"vxunderground. (2021, June 30). VX-API. Retrieved April 1, 2022.","url":"https://web.archive.org/web/20250904153443/https://github.com/vxunderground/VX-API/tree/main#anti-debug"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1622","id":"T1622","name":"Debugger Evasion","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1622","technique_page":"techniques/enterprise/T1622/","page":"detections/enterprise/T1622/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"811e0002-b13b-4a15-9d00-a613fce66e42","title":"PUA - Process Hacker Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/811e0002-b13b-4a15-9d00-a613fce66e42.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_process_hacker.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0371","name":"Detection Strategy for Debugger Evasion (T1622)","url":"https://attack.mitre.org/detectionstrategies/DET0371","stix_id":"x-mitre-detection-strategy--22f3a380-389d-44f7-a846-c6223fc06ddd","relationship_id":"relationship--e6bda228-b1c4-4fc7-b877-457557628832","description":"","analytics":[{"id":"AN1045","name":"Analytic 1045","guidance":"Monitor for suspicious use of Windows API calls such as IsDebuggerPresent() and NtQueryInformationProcess(), or processes manually checking the BeingDebugged flag in the Process Environment Block (PEB). Detect sequences of OutputDebugStringW() calls in short intervals that may indicate debugger flooding attempts.","url":"https://attack.mitre.org/detectionstrategies/DET0371#AN1045","platforms":["Windows"],"tuning":[{"field":"ApiCallFrequencyThreshold","description":"Number of repeated debug-related API calls allowed before raising an alert"},{"field":"ProcessAllowList","description":"Legitimate debuggers or developer tools that may trigger similar behaviors"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1045","source_url":"https://attack.mitre.org/detectionstrategies/DET0371#AN1045","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0021","component":"OS API Execution","name":"etw:Microsoft-Windows-Kernel-Process","channel":"NtQueryInformationProcess","platforms":["Windows"],"analytic_id":"AN1045","source_url":"https://attack.mitre.org/detectionstrategies/DET0371#AN1045","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]},{"id":"AN1046","name":"Analytic 1046","guidance":"Monitor access to /proc/self/status where TracerPID field is queried, as this is a common technique for debugger detection. Detect processes that attempt to trigger exceptions intentionally and monitor whether exception handling indicates presence of a debugger.","url":"https://attack.mitre.org/detectionstrategies/DET0371#AN1046","platforms":["Linux"],"tuning":[{"field":"MonitoredPaths","description":"Set of /proc paths to monitor for suspicious access"},{"field":"SyscallThreshold","description":"Rate of syscalls (open/read) used to detect repeated probing for debug artifacts"}],"log_sources":[{"component_id":"DC0055","component":"File Access","name":"auditd:SYSCALL","channel":"open/read: Access to /proc/self/status with focus on TracerPID field","platforms":["Linux"],"analytic_id":"AN1046","source_url":"https://attack.mitre.org/detectionstrategies/DET0371#AN1046","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN1047","name":"Analytic 1047","guidance":"Detect suspicious calls to sysctl or ptrace API used to determine if a process is being debugged. Monitor for processes that flood OutputDebugString equivalents or generate abnormal exceptions to evade analysis.","url":"https://attack.mitre.org/detectionstrategies/DET0371#AN1047","platforms":["macOS"],"tuning":[{"field":"PtraceInvocationThreshold","description":"Number of ptrace calls in a time window that should raise suspicion"},{"field":"DevToolExclusionList","description":"Exclude known developer tools and monitoring agents"}],"log_sources":[{"component_id":"DC0021","component":"OS API Execution","name":"macos:unifiedlog","channel":"ptrace: Processes invoking ptrace with PTRACE_TRACEME flag","platforms":["macOS"],"analytic_id":"AN1047","source_url":"https://attack.mitre.org/detectionstrategies/DET0371#AN1047","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]}]}],"telemetry_references":[{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) has made calls to Windows API `CheckRemoteDebuggerPresent` and exits if it detects a debugger.(Citation: Sophos Mustang Panda PLUGX)","relationship_id":"relationship--0644d7f4-edb2-4fbf-81bb-498d1962ad4e","references":[{"source_name":"Sophos Mustang Panda PLUGX","description":"Secureworks Counter Threat Unit Research Team. (2022, September 8). BRONZE PRESIDENT Targets Government Officials. Retrieved September 9, 2025.","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can check for debugging tools.(Citation: Talos Group123)(Citation: NCCGroup RokRat Nov 2018)(Citation: Malwarebytes RokRAT VBA January 2021)","relationship_id":"relationship--4eb00375-3ee3-43c7-845a-2206e1eff114","references":[{"source_name":"Malwarebytes RokRAT VBA January 2021","description":"Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"},{"source_name":"Talos Group123","description":"Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"},{"source_name":"NCCGroup RokRat Nov 2018","description":"Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.","url":"https://research.nccgroup.com/2018/11/08/rokrat-analysis/"}]},{"id":"S0595","name":"ThiefQuest","url":"https://attack.mitre.org/software/S0595","kind":"malware","description":"[ThiefQuest](https://attack.mitre.org/software/S0595) uses a function named <code>is_debugging</code> to perform anti-debugging logic. The function invokes <code>sysctl</code> checking the returned value of <code>P_TRACED</code>. [ThiefQuest](https://attack.mitre.org/software/S0595) also calls <code>ptrace</code> with the <code>PTRACE_DENY_ATTACH</code> flag to prevent debugging.(Citation: wardle evilquest partii)","relationship_id":"relationship--e711d51c-94d3-4a20-ae11-d3584bae36d9","references":[{"source_name":"wardle evilquest partii","description":"Patrick Wardle. (2020, July 3). OSX.EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021.","url":"https://objective-see.com/blog/blog_0x60.html"}]},{"id":"S0694","name":"DRATzarus","url":"https://attack.mitre.org/software/S0694","kind":"malware","description":"[DRATzarus](https://attack.mitre.org/software/S0694) can use `IsDebuggerPresent` to detect whether a debugger is present on a victim.(Citation: ClearSky Lazarus Aug 2020)","relationship_id":"relationship--50446870-ba6c-4d0c-b657-586a6cba8903","references":[{"source_name":"ClearSky Lazarus Aug 2020","description":"ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) has used `is_debugger_present` as part of its environmental checks.(Citation: Malwarebytes Saint Bot April 2021)","relationship_id":"relationship--885a3674-5a25-42e4-aa7f-148a41493861","references":[{"source_name":"Malwarebytes Saint Bot April 2021","description":"Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"}]},{"id":"S1039","name":"Bumblebee","url":"https://attack.mitre.org/software/S1039","kind":"malware","description":"[Bumblebee](https://attack.mitre.org/software/S1039) can search for tools used in static analysis.(Citation: Medium Ali Salem Bumblebee April 2022)","relationship_id":"relationship--f015b898-b057-40e4-9add-c4fa1e100f7e","references":[{"source_name":"Medium Ali Salem Bumblebee April 2022","description":"Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.","url":"https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can search for debugging tools on a compromised host.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--cce43f73-d564-4c60-9492-52b3f7039b7b","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1066","name":"DarkTortilla","url":"https://attack.mitre.org/software/S1066","kind":"malware","description":"[DarkTortilla](https://attack.mitre.org/software/S1066) can detect debuggers by using functions such as `DebuggerIsAttached` and `DebuggerIsLogging`. [DarkTortilla](https://attack.mitre.org/software/S1066) can also detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.(Citation: Secureworks DarkTortilla Aug 2022)","relationship_id":"relationship--c6cc5a76-522d-4b48-ae5b-4867fa87f2c6","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"The [Black Basta](https://attack.mitre.org/software/S1070) dropper can check system flags, CPU registers, CPU instructions, process timing, system libraries, and APIs to determine if a debugger is present.(Citation: Check Point Black Basta October 2022)","relationship_id":"relationship--6bc08584-0dc8-494f-967f-50adc9464843","references":[{"source_name":"Check Point Black Basta October 2022","description":"Check Point. (2022, October 20). BLACK BASTA AND THE UNNOTICED DELIVERY. Retrieved March 8, 2023.","url":"https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/"}]},{"id":"S1087","name":"AsyncRAT","url":"https://attack.mitre.org/software/S1087","kind":"tool","description":"[AsyncRAT](https://attack.mitre.org/software/S1087) can use the `CheckRemoteDebuggerPresent` function to detect the presence of a debugger.(Citation: Telefonica Snip3 December 2021)","relationship_id":"relationship--0324f691-2708-4272-86a5-e0cb40aeba9e","references":[{"source_name":"Telefonica Snip3 December 2021","description":"Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) checks the <code>BeingDebugged</code> flag in the PEB structure during execution to identify if the malware is being debugged.(Citation: Trellix Darkgate 2023)","relationship_id":"relationship--23a7a9eb-b34a-4852-801a-ecab7702bbd8","references":[{"source_name":"Trellix Darkgate 2023","description":"Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024.","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) leverages anti-debugging mechanisms through the use of <code>ThreadHideFromDebugger</code>.(Citation: TrendMicro RaspberryRobin 2022)","relationship_id":"relationship--b0e22e39-2b6c-4b27-8fd1-e9855194449e","references":[{"source_name":"TrendMicro RaspberryRobin 2022","description":"Christopher So. (2022, December 20). Raspberry Robin Malware Targets Telecom, Governments. Retrieved May 17, 2024.","url":"https://www.trendmicro.com/en_us/research/22/l/raspberry-robin-malware-targets-telecom-governments.html"}]},{"id":"S1145","name":"Pikabot","url":"https://attack.mitre.org/software/S1145","kind":"malware","description":"[Pikabot](https://attack.mitre.org/software/S1145) features several methods to evade debugging by analysts, including checks for active debuggers, the use of breakpoints during execution, and checking various system information items such as system memory and the number of processors.(Citation: Zscaler Pikabot 2023)(Citation: Elastic Pikabot 2024)(Citation: Logpoint Pikabot 2024)","relationship_id":"relationship--44a27941-a92a-4dd8-ab62-e30f6d8782e3","references":[{"source_name":"Zscaler Pikabot 2023","description":"Brett Stone-Gross & Nikolaos Pantazopoulos. (2023, May 24). Technical Analysis of Pikabot. Retrieved July 12, 2024.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot"},{"source_name":"Elastic Pikabot 2024","description":"Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024.","url":"https://www.elastic.co/security-labs/pikabot-i-choose-you"},{"source_name":"Logpoint Pikabot 2024","description":"Swachchhanda Shrawan Poudel. (2024, February). Pikabot: 
 A Sophisticated and Modular Backdoor Trojan with Advanced Evasion Techniques. Retrieved July 12, 2024.","url":"https://www.logpoint.com/wp-content/uploads/2024/02/logpoint-etpr-pikabot.pdf"}]},{"id":"S1160","name":"Latrodectus","url":"https://attack.mitre.org/software/S1160","kind":"malware","description":"\n[Latrodectus](https://attack.mitre.org/software/S1160) has the ability to check for the presence of debuggers.(Citation: Latrodectus APR 2024)","relationship_id":"relationship--ebb04a61-225d-4cd3-b589-b3001069566e","references":[{"source_name":"Latrodectus APR 2024","description":"Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]},{"id":"S1183","name":"StrelaStealer","url":"https://attack.mitre.org/software/S1183","kind":"malware","description":"[StrelaStealer](https://attack.mitre.org/software/S1183) variants include functionality to identify and evade debuggers.(Citation: Fortgale StrelaStealer 2023)","relationship_id":"relationship--2157f938-0fce-462e-b0aa-9749414d4972","references":[{"source_name":"Fortgale StrelaStealer 2023","description":"Fortgale. (2023, September 18). StrelaStealer Malware Analysis. Retrieved December 31, 2024.","url":"https://fortgale.com/blog/malware-analysis/strelastealer-malware-analysis-2/"}]},{"id":"S1200","name":"StealBit","url":"https://attack.mitre.org/software/S1200","kind":"malware","description":"[StealBit](https://attack.mitre.org/software/S1200) can detect it is being run in the context of a debugger.(Citation: Cybereason StealBit Exfiltration Tool)","relationship_id":"relationship--1199931b-4232-4751-8d7d-5e096bcd3868","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","description":"Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can check heap memory parameters for indications of a debugger and stop the flow of events to the attached debugger in order to hinder dynamic analysis.(Citation: Sentinel Labs LockBit 3.0 JUL 2022)","relationship_id":"relationship--b6e9f75a-6cf1-400a-a282-a43214dfb729","references":[{"source_name":"Sentinel Labs LockBit 3.0 JUL 2022","description":"Walter, J. (2022, July 21). LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques. Retrieved February 5, 2025.","url":"https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"}]},{"id":"S1207","name":"XLoader","url":"https://attack.mitre.org/software/S1207","kind":"malware","description":"[XLoader](https://attack.mitre.org/software/S1207) uses anti-debugging mechanisms such as calling `NtQueryInformationProcess` with `InfoClass=7`, referencing `ProcessDebugPort`, to determine if it is being analyzed.(Citation: Google XLoader 2017)","relationship_id":"relationship--a9db541b-987a-4416-a721-3d59012b86e5","references":[{"source_name":"Google XLoader 2017","description":"Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/"}]},{"id":"S1213","name":"Lumma Stealer","url":"https://attack.mitre.org/software/S1213","kind":"malware","description":"[Lumma Stealer](https://attack.mitre.org/software/S1213) has checked for debugger strings by invoking `GetForegroundWindow` and looks for strings containing “x32dbg”, “x64dbg”, “windbg”, “ollydbg”, “dnspy”, “immunity debugger”, “hyperdbg”, “debug”, “debugger”, “cheat engine”, “cheatengine” and “ida”.(Citation: Fortinet LummaStealer 2024)","relationship_id":"relationship--02c214f7-2c16-462f-9cc0-169c794f4e06","references":[{"source_name":"Fortinet LummaStealer 2024","description":"Cara Lin, Fortinet. (2024, January 8). Deceptive Cracked Software Spreads Lumma Variant on YouTube. Retrieved March 22, 2025.","url":"https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"[PUBLOAD](https://attack.mitre.org/software/S1228) has embedded debug strings with messages to distract analysts.(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)  [PUBLOAD](https://attack.mitre.org/software/S1228) has leveraged `OutputDebugStringW` and `OutputDebugStringA` functions.(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)","relationship_id":"relationship--5013757f-2af8-43ce-b0cd-b625ca0bcf58","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","description":"Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has leveraged custom exception handlers to hide code flow and stop execution of a debugger.(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)","relationship_id":"relationship--b66fc48f-d106-493c-9c32-4037288b9fb7","references":[{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"id":"S9019","name":"PureCrypter","url":"https://attack.mitre.org/software/S9019","kind":"malware","description":"[PureCrypter](https://attack.mitre.org/software/S9019) has the ability to call `CheckRemoteDebuggerPresent`.(Citation: Zscaler PureCrypter JUN 2022)","relationship_id":"relationship--7073777a-12f6-4afa-aa0d-8be1b29cf63b","references":[{"source_name":"Zscaler PureCrypter JUN 2022","description":"Dumont, R. (2022, June 13). Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers. Retrieved April 16, 2026.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"}]},{"id":"S9027","name":"ANELLDR","url":"https://attack.mitre.org/software/S9027","kind":"malware","description":"[ANELLDR](https://attack.mitre.org/software/S9027) can call `ZwSetInformationThread` with the second argument set to `ThreadHideFromDebugger (0x11)` to evade being debugged.(Citation: Trend Micro Earth Kasha Anel NOV 2024)","relationship_id":"relationship--ac588a85-7bc7-447a-8ebd-243af2a8dd62","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","description":"Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"}]},{"id":"S9037","name":"RustyWater","url":"https://attack.mitre.org/software/S9037","kind":"malware","description":"[RustyWater](https://attack.mitre.org/software/S9037) has registered a Vectored Exception Handler (VEH) to catch debugging efforts.(Citation: CloudSEK_RustyWater_Jan2026)","relationship_id":"relationship--a64c7c7d-f08c-40a3-802b-e25fe9eaea6c","references":[{"source_name":"CloudSEK_RustyWater_Jan2026","description":"Awasthi, P. (2026, January 8). Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant. Retrieved March 19, 2026.","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has used the `IsDebuggerPresent` function to detect whether a debugger is present on a victim machine.(Citation: Cyfirma_Vidar_June2024)","relationship_id":"relationship--3ab5dbba-b0a5-4973-95c0-2d8af10701c5","references":[{"source_name":"Cyfirma_Vidar_June2024","description":"CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"}]}],"actors":[{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has embedded debug strings with messages to distract analysts.(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload) [Mustang Panda](https://attack.mitre.org/groups/G0129) has also made calls to Windows API `CheckRemoteDebuggerPresent` and exits if it detects a debugger.(Citation: Sophos Mustang Panda PLUGX) ","relationship_id":"relationship--9ce98ef3-1951-460b-93c6-2ded0edc8dfd","references":[{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Sophos Mustang Panda PLUGX","description":"Secureworks Counter Threat Unit Research Team. (2022, September 8). BRONZE PRESIDENT Targets Government Officials. Retrieved September 9, 2025.","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}]}],"mitigations":[],"candidates":[{"id":"58bd8c8d-3a1a-4467-a69c-439c75469b07","name":"Detect a Debugger Presence in the Machine","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1622/T1622.yaml","description":"Detecting a running debugger process or if the debugger is attached to a process via PowerShell","inputs":{},"dependencies":[],"source_definition_sha256":"dda528577f052482ca393df4270f4189d9fa4e50f4a82d783eddad9d719f3039"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1497":"/ttp-simulation/techniques/enterprise/T1497/","T1106":"/ttp-simulation/techniques/enterprise/T1106/","T1622":"/ttp-simulation/techniques/enterprise/T1622/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1622","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}