
(CAPA) CAPA_output_debug_string
Created the . Updated 1 year, 3 months ago.
rule:
meta:
name: check for OutputDebugString error
namespace: anti-analysis/anti-debugging/debugger-detection
author: michael.hunhoff@fireeye.com
scope: function
mbc:
- Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016]
examples:
- Practical Malware Analysis Lab 16-02.exe_:0x401020
features:
- and:
- api: kernel32.SetLastError
- api: kernel32.GetLastError
- api: kernel32.OutputDebugString
Associated Techniques
Technique Name | Technique ID's | Has Snippet(s) |
---|---|---|
OutputDebugString | U0117 B0001.016 |