rule: meta: name: check for protected handle exception namespace: anti-analysis/anti-debugging/debugger-detection author: michael.hunhoff@fireeye.com scope: function mbc: - Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024] references: - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SetHandleInformation_API.cpp examples: - al-khaser_x86.exe_:0x430D20 features: - and: - basic block: - and: - count(number(2)): 2 or more - api: SetHandleInformation - api: CloseHandle