Anti-Debugging

Technique Name	Technique ID's	Snippet(s)	Rules(s)	OS
SuspendThread	U0101 C0055
Guard Pages	U0102 B0006.006
NtSetDebugFilterState	U0103
Bad String Format	U0104
INT3 Instruction Scanning	U0105 B0001.025
Interrupts	U0106
Performing Code Checksum	U0107
Unhandled Exception Filter	U0108 B0001.030
Detecting Running Process: EnumProcess API	U0109 U0405 U1306
GetLocalTime, GetSystemTime, timeGetTime, NtQueryPerformanceCounter	U0110 U1308 B0001.28
NtGlobalFlag	U0111 B0001.036
Heap Flag	U0112 B0001.021
IsDebugged Flag	U0113 B0001.019
CloseHandle, NtClose	U0114 B0001.003
CsrGetProcessID	U0115
EventPairHandles	U0116
OutputDebugString	U0117 B0001.016
NtQueryObject	U0118 B0001.013
NtSetInformationThread	U0119 B0001.014
NtQueryInformationProcess	U0120 B0001.012
CheckRemoteDebuggerPresent	U0121 B0001.002
IsDebuggerPresent	U0122 B0001.008
TLS Callback	U0124
Call to Interrupt Procedure	U0124
AddVectoredExceptionHandler	U0125
GetTickCount	U0125 B0001.032
RDTSC	U0126
Debug Registers, Hardware Breakpoints	U0127 B0001.005
LocalSize(0)	U0128
INT 0x2D	U0129 B0001.006
ICE 0xF1	U0130
Trap Flag	U0131
FuncIn	U0132 U0221 U0308
Al-Khaser_WriteWatch	U0134
kernel flag inspection via sysctl	U0135
Detecting Window with FindWindow API	U0406 U0123
NtDelayExecution	U1344 U0133