rule Detect_NtSetInformationThread: AntiDebug { meta: description = "Detect NtSetInformationThread as anti-debug" author = "Unprotect" comment = "Experimental rule" strings: $1 = "NtSetInformationThread" fullword ascii condition: uint16(0) == 0x5A4D and filesize < 1000KB and $1 }