Al-Khaser_WriteWatch

Default invalid parameter values of Al-Khaser's Anti-Debug technique (VirtualAlloc/MEM_WRITE_WATCH). Used for checking API hooks in debuggers/sandboxes.

Technique Identifier

U0134

Evasion Categories

Anti-Debugging

Detection Rules

rule YARA_Detect_AlKhaser_AntiDebug_WriteWatch
{
    meta:
        description = "Default invalid parameter values of Al-Khaser's Anti-Debug technique (VirtualAlloc/MEM_WRITE_WATCH). Used for checking API hooks in debuggers/sandboxes."
        author = "@albertzsigovits"
        date = "2024-07-10"
        reference = "https://github.com/LordNoteworthy/al-khaser/blob/967afa0d783ff9625caf1b069e3cd1246836b09f/al-khaser/AntiDebug/WriteWatch.cpp#L85"
        sha256 = "e07383f6a340d8422a69b1d40cf848652165517407f7d0dc7260eed4a76499b3"

    strings:
        $ = "%ThisIsAnInvalidEnvironmentVariableName?[]<>@\\;*!-{}#:/~%" ascii wide
        $ = "%ThisIsAnInvalidFileName?[]<>@\\;*!-{}#:/~%" ascii wide
    condition:
        uint16(0) == 0x5A4D
        and uint32(uint32(0x3C)) == 0x00004550
        and any of them
}

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

al-khaser/al-khaser/AntiDebug/WriteWatch.cpp at 967afa0d783ff9625caf1b069e3cd1246836b09f · LordNoteworthy/al-khaser · GitHub

Matching Samples 10 most recent

Sample Name	Matching Techniques	First Seen	Last Seen
al-khaser.exe	24	2024-11-13	1 year, 4 months ago

View All

Created

August 19, 2024

Last Revised

March 24, 2026