rule Detect_SuspendThread: AntiDebug { meta: description = "Detect SuspendThread as anti-debug" author = "Unprotect" comment = "Experimental rule" strings: $1 = "UnhandledExcepFilter" fullword ascii $2 = "SetUnhandledExceptionFilter" fullword ascii condition: uint16(0) == 0x5A4D and filesize < 1000KB and any of them }