(YARA) YARA_Detect_ExceptionHandler
rule Detect_SuspendThread: AntiDebug {
meta:
description = "Detect SuspendThread as anti-debug"
author = "Unprotect"
comment = "Experimental rule"
strings:
$1 = "UnhandledExcepFilter" fullword ascii
$2 = "SetUnhandledExceptionFilter" fullword ascii
condition:
uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}
Associated Techniques
| Technique Name | Technique ID's | Snippet(s) | OS |
|---|---|---|---|
| Unhandled Exception Filter | U0108 B0001.030 |
Matching Samples 10 most recent
| Sample Name | Matching Techniques | First Seen | Last Seen |
|---|---|---|---|
| Lightshot.exe | 10 | 2025-10-24 | 4 days, 11 hours ago |
| Scalper_Telegram@Val1312q.dll | 8 | 2025-10-21 | 1 week ago |
| HogwartsLegacy.exe | 7 | 2025-10-16 | 1 week, 5 days ago |
| a.exe | 7 | 2025-10-03 | 3 weeks, 4 days ago |
| program.exe | 6 | 2025-10-01 | 3 weeks, 6 days ago |
| LoadThatPe.exe | 5 | 2025-09-29 | 4 weeks, 1 day ago |
| botnpwds.exe | 10 | 2025-09-24 | 1 month ago |
| DNS-C2.exe84-rednefed-swodniw-8snoci.exe | 6 | 2025-09-23 | 1 month ago |
| DSViper_AES.exe | 8 | 2025-09-23 | 1 month ago |
| hid-tools.dll | 13 | 2025-09-22 | 1 month ago |
Created
June 22, 2022
Last Revised
June 22, 2022