(YARA) YARA_Detect_CloseHandle

Download Raw

rule Detect_CloseHandle: AntiDebug {
    meta: 
        description = "Detect CloseHandle as anti-debug"
        author = "Unprotect"
        comment = "Experimental rule"
    strings:
        $1 = "NtClose" fullword ascii
        $2 = "CloseHandle" fullword ascii
    condition:   
       uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
CloseHandle, NtClose U0114 B0001.003

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
cobalt_sample.exe 13 2025-05-25 1 week ago
flushes.exe 7 2025-05-24 1 week ago
unload_sysmon_x64.exe 6 2025-05-18 1 week, 6 days ago
ZAP.exe 6 2025-04-26 1 month ago
TCS30Autoplay_Net.exe 6 2025-04-25 1 month ago
SetupEngine.exe 8 2025-04-23 1 month, 1 week ago
FBH.dll 10 2025-03-22 2 months, 1 week ago
MS-RPRN.exe 7 2025-03-12 2 months, 2 weeks ago
RustPatchlessCLRLoader.exe 8 2025-03-07 2 months, 3 weeks ago
stub_modified.exe 7 2025-02-18 3 months, 1 week ago
View All

Created

June 22, 2022

Last Revised

June 22, 2022