
(YARA) YARA_Detect_IsDebuggerPresent
June 22, 2022, 2:06 a.m. | 2 weeks
rule Detect_IsDebuggerPresent : AntiDebug {
meta:
author = "naxonez"
reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
strings:
$ ="IsDebugged"
condition:
uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}
Associated Techniques
Technique Name | Technique ID's | Has Snippet(s) |
---|---|---|
IsDebuggerPresent | U0122 |