
(CAPA) CAPA_output_debug_string
June 20, 2022, midnight | 2 weeks, 2 days
rule:
meta:
name: check for OutputDebugString error
namespace: anti-analysis/anti-debugging/debugger-detection
author: michael.hunhoff@fireeye.com
scope: function
mbc:
- Anti-Behavioral Analysis::Debugger Detection::OutputDebugString [B0001.016]
examples:
- Practical Malware Analysis Lab 16-02.exe_:0x401020
features:
- and:
- api: kernel32.SetLastError
- api: kernel32.GetLastError
- api: kernel32.OutputDebugString
Associated Techniques
Technique Name | Technique ID's | Has Snippet(s) |
---|---|---|
OutputDebugString | U0117 |