(CAPA) CAPA_output_debug_string

June 20, 2022, midnight | 2 weeks, 2 days 
            rule:
  meta:
    name: check for OutputDebugString error
    namespace: anti-analysis/anti-debugging/debugger-detection
    author: michael.hunhoff@fireeye.com
    scope: function
    mbc:
      - Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016]
    examples:
      - Practical Malware Analysis Lab 16-02.exe_:0x401020
  features:
    - and:
      - api: kernel32.SetLastError
      - api: kernel32.GetLastError
      - api: kernel32.OutputDebugString
Download Raw

Associated Techniques

Technique Name Technique ID's Has Snippet(s)
OutputDebugString U0117

Comment