(CAPA) CAPA_SetHandleInformation
Created the . Updated 2 years, 3 months ago.
rule:
meta:
name: check for protected handle exception
namespace: anti-analysis/anti-debugging/debugger-detection
author: michael.hunhoff@fireeye.com
scope: function
mbc:
- Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024]
references:
- https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SetHandleInformation_API.cpp
examples:
- al-khaser_x86.exe_:0x430D20
features:
- and:
- basic block:
- and:
- count(number(2)): 2 or more
- api: SetHandleInformation
- api: CloseHandle
Associated Techniques
Technique Name | Technique ID's | Snippet(s) | OS |
---|---|---|---|
CloseHandle, NtClose | U0114 B0001.003 |