(CAPA) CAPA_localsize

Download Raw 

rule:
  meta:
    name: trap debugger with localsize
    namespace: anti-analysis/anti-debugging
    author: lordtmk@protonmail.com
    scope: basic block
    examples:
      - B67E5B1985742F62785122B637EF4FBD:0x4B1F5B
  features:
    - and:
      - api: LocalSize
      - mnemonic: push 
      - number: 0

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
LocalSize(0) U0128
Created

June 20, 2022

Last Revised

June 20, 2022