T1622StealthDiscovery
Debugger Evasion
Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads. Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment. Similar to Virtualization/Sandbox Evasion, if the adversary detects…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports0
Detections
1 Sigma rule tagged T1622Debugger EvasionT16221 general rule
- PUA - Process Hacker Executionmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Debugger Evasion
2 CVEs, by priority. Each link shows its badge.- CVE-2022-42475Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityFortinet · FortiOSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1574Hijack Execution Flow+2 more · 4 reportsMITRE CTID mapping of the KEV entry · follow-on activity99.5%Top 0.06%88.8priority
- CVE-2015-3113Adobe Flash Player Heap-Based Buffer Overflow VulnerabilityAdobe · Flash PlayerKEVPublic exploitCritical · 9.8T1497Virtualization/Sandbox EvasionT1622Debugger Evasion+1 more · 3 reportsMITRE CTID mapping of the KEV entry · follow-on activity99.8%Top 0.04%77.6priority