MITRE ATT&CKtechnique

T1622 Debugger Evasion

Published 2022-04-01 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Stealth, Discovery
Platforms
Linux, macOS, Windows
Version
2.0
Created
2022-04-01

Description

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads. Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment. Similar to Virtualization/Sandbox Evasion, if the adversary detects a debugger, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for debugger artifacts before dropping secondary or additional payloads. Specific checks will vary based on the target and/or adversary. On Windows, this may involve Native API function calls such as IsDebuggerPresent() and NtQueryInformationProcess(), or manually checking the BeingDebugged flag of the Process Environment Block (PEB). On Linux, this may involve querying `/proc/self/status` for the `TracerPID` field, which indicates whether or not the process is being traced by dynamic analysis tools. Other checks for debugging artifacts may also seek to enumerate hardware breakpoints, interrupt assembly opcodes, time checks, or measurements if exceptions are raised in the current process (assuming a present debugger would “swallow” or handle the potential error). Malware may also leverage Structured Exception Handling (SEH) to detect debuggers by throwing an exception and detecting whether the process is suspended. SEH handles both hardware and software expectations, providing control over the exceptions including support for debugging. If a debugger is present, the program’s control will be transferred to the debugger, and the execution of the code will be suspended. If the debugger is not present, control will be transferred to the SEH handler, which will automatically handle the exception and allow the program’s execution to continue. Adversaries may use the information learned from these debugger checks during automated discovery to shape follow-on behaviors. Debuggers can also be evaded by detaching the process or flooding debug logs with meaningless data via messages produced by looping Native API function calls such as OutputDebugStringW().

Related

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · uses (27)

  • S9050 Vidar software (malware)
  • S9037 RustyWater software (malware)
  • S9027 ANELLDR software (malware)
  • S9019 PureCrypter software (malware)
  • S1239 TONESHELL software (malware)
  • S1228 PUBLOAD software (malware)
  • S1213 Lumma Stealer software (malware)
  • S1207 XLoader software (malware)
  • S1202 LockBit 3.0 software (malware)
  • S1200 StealBit software (malware)
  • S1183 StrelaStealer software (malware)
  • S1160 Latrodectus software (malware)
  • S1145 Pikabot software (malware)
  • S1130 Raspberry Robin software (malware)
  • S1111 DarkGate software (malware)
  • S1087 AsyncRAT software (tool)
  • C0022 Operation Dream Job campaign
  • S1070 Black Basta software (malware)
  • S1066 DarkTortilla software (malware)
  • S1060 Mafalda software (malware)
  • S1039 Bumblebee software (malware)
  • S1018 Saint Bot software (malware)
  • S0694 DRATzarus software (malware)
  • G0129 Mustang Panda group
  • S0595 ThiefQuest software (malware)
  • S0240 ROKRAT software (malware)
  • S0013 PlugX software (malware)

Referenced by Compliance · mitigates (15)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-SC-23 Session Authenticity NIST 800-53 control
  • NIST-SC-46 Cross Domain Policy Enforcement NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SC-8 Transmission Confidentiality and Integrity NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-15 Information Output Filtering NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References