TLS Callback

Created the Monday 18 March 2019. Updated 1 year, 2 months ago.

TLS (Thread Local Storage) callbacks are a mechanism in Windows that allows a program to define a function that will be called when a thread is created. These callbacks can be used to perform various tasks, such as initializing thread-specific data or modifying the behavior of the thread.

As an anti-debugging technique, a program can use a TLS callback to execute code before the main entry point of the program, which is defined in the PE (Portable Executable) header. This allows the program to run secretly in a debugger, as the debugger will typically start at the main entry point and may not be aware of the TLS callback.

The program can use the TLS callback to detect whether it is being debugged, and if it is, it can terminate the process or take other actions to evade debugging. This technique can be used to make it more difficult for a debugger to attach to the process and to hinder reverse engineering efforts.



Code Snippets

Detection Rules

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
test.exe 7 2024-12-06 6 hours, 1 minute ago
EDR Silencer 1.4.exe 8 2024-11-29 1 week ago
Xulytaikhoan.xlsx 14 2024-11-26 1 week, 3 days ago
EDRSilencer.exe 9 2024-11-14 3 weeks, 1 day ago
nop_check_final.exe 8 2024-11-13 3 weeks, 1 day ago
View All

Sleeping Alien

Subscribe to our Newsletter

Don't miss out on the latest and greatest updates from us! Subscribe to our newsletter and be the first to know about exciting content and future updates.