The NtSetDebugFilterState and DbgSetDebugFilterState functions are used by malware to detect the presence of a kernel mode debugger. These functions allow the malware to set up a debug filter, which is a mechanism that can be used to detect and respond to the presence of a debugger.

When a kernel mode debugger is present, the debug filter will be …