TLS Callback
Created the Monday 18 March 2019. Updated 1 year, 2 months ago.
TLS (Thread Local Storage) callbacks are a mechanism in Windows that allows a program to define a function that will be called when a thread is created. These callbacks can be used to perform various tasks, such as initializing thread-specific data or modifying the behavior of the thread.
As an anti-debugging technique, a program can use a TLS callback to execute code before the main entry point of the program, which is defined in the PE (Portable Executable) header. This allows the program to run secretly in a debugger, as the debugger will typically start at the main entry point and may not be aware of the TLS callback.
The program can use the TLS callback to detect whether it is being debugged, and if it is, it can terminate the process or take other actions to evade debugging. This technique can be used to make it more difficult for a debugger to attach to the process and to hinder reverse engineering efforts.
Technique Identifier
Technique Tags
TLS callbacks anti-debugging technique thread main entry point debugger
Code Snippets
Detection Rules
Additional Resources
External Links
The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.
- https://resources.infosecinstitute.com/debugging-tls-callbacks/#gref
- InfoSec Handlers Diary Blog - SANS Internet Storm Center
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
test.exe | 7 | 2024-12-06 | 6 hours, 1 minute ago |
EDR Silencer 1.4.exe | 8 | 2024-11-29 | 1 week ago |
Xulytaikhoan.xlsx | 14 | 2024-11-26 | 1 week, 3 days ago |
EDRSilencer.exe | 9 | 2024-11-14 | 3 weeks, 1 day ago |
nop_check_final.exe | 8 | 2024-11-13 | 3 weeks, 1 day ago |