Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1622_debugger-evasion
Adversaries may employ various means to detect and avoid debuggers.
Passed 19 of 21 test cases with the skill, and 15 of 21 without it.
and 2 more in the full report
4 fixed16 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
When documenting MITRE ATT&CK technique T1622 for an enterprise SOC playbook, which specific ATT&CK Tactics (Kill Chain Phases) must this technique be mapped to?
| Checked | Without skill | With skill |
|---|---|---|
| Maps T1622 to the Defense Evasion tactic (TA0005) | Passed | Passed |
| Maps T1622 to the Discovery tactic (TA0007) | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.
Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment. Similar to Virtualization/Sandbox Evasion, if the adversary detects a debugger, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for debugger artifacts before dropping secondary or additional payloads.
Specific checks will vary based on the target and/or adversary. On Windows, this may involve Native API function calls such as IsDebuggerPresent() and NtQueryInformationProcess(), or manually checking the BeingDebugged flag of the Process Environment Block (PEB). On Linux, this may involve querying /proc/self/status for the TracerPID field, which indicates whether or not the process is being traced by dynamic analysis tools. Other checks for debugging artifacts may also seek to enumerate hardware breakpoints, interrupt assembly opcodes, time checks, or measurements if exceptions are raised in the current process (assuming a present debugger would “swallow” or handle the potential error).
Malware may also leverage Structured Exception Handling (SEH) to detect debuggers by throwing an exception and detecting whether the process is suspended. SEH handles both hardware and software expectations, providing control over the exceptions including support for debugging. If a debugger is present, the program’s control will be transferred to the debugger, and the execution of the code will be suspended. If the debugger is not present, control will be transferred to the SEH handler, which will automatically handle the exception and allow the program’s execution to continue.
Adversaries may use the information learned from these debugger checks during automated discovery to shape follow-on behaviors. Debuggers can also be evaded by detaching the process or flooding debug logs with meaningless data via messages produced by looping Native API function calls such as OutputDebugStringW().
Platforms: Linux, macOS, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Detecting a running debugger process or if the debugger is attached to a process via PowerShell
Supported Platforms: windows
test cases passed, vs 15 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.