
(YARA) YARA_detect_tlscallback
Created the . Updated 1 year, 3 months ago.
rule detect_tlscallback {
meta:
description = "Simple rule to detect tls callback as anti-debug."
author = "Thomas Roccia | @fr0gger_"
strings:
$str1 = "TLS_CALLBACK" nocase
$str2 = "TLScallback" nocase
condition:
uint32(uint32(0x3C)) == 0x4550 and any of them
}
Associated Techniques
Technique Name | Technique ID's | Has Snippet(s) |
---|---|---|
TLS Callback | U0124 |