Mustang PandaG0129 ↗
Has embedded debug strings with messages to distract analysts.1 Mustang Panda has also made calls to Windows API CheckRemoteDebuggerPresent and exits if it detects a debugger.2
tfMITRE ATT&CK technique
Debugger Evasion T1622
- Platforms
- Linux, macOS, Windows
- Version
- 2.0
- Created
- 01 April 2022
- Last modified
- 12 May 2026
- Contributors
- Joas Antonio dos Santos, @C0d3Cr4zy; TruKno
Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
1
Threat groups45th pct
Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.24
Tools & malwareTop 14%
Tools & malware86th percentile · 86% of ATT&CK techniques have this many tools implementing them or fewer.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Debugger Evasion MITRE reference T1622
45th pctamong all ATT&CK techniques for number of groups
1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 1 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Operation Dream JobC0022 ↗
During Operation Dream Job, Lazarus Group used tools that used the IsDebuggerPresent call to detect debuggers.1
All 1 campaigns for this technique
24 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
RustyWaterS9037 ↗
Has registered a Vectored Exception Handler (VEH) to catch debugging efforts.1
ANELLDRS9027 ↗
Can call ZwSetInformationThread with the second argument set to ThreadHideFromDebugger (0x11) to evade being debugged.1
PureCrypterS9019 ↗
Has the ability to call CheckRemoteDebuggerPresent.1
TONESHELLS1239 ↗
Has leveraged custom exception handlers to hide code flow and stop execution of a debugger.1
PUBLOADS1228 ↗
Has embedded debug strings with messages to distract analysts.12 PUBLOAD has leveraged OutputDebugStringW and OutputDebugStringA functions.2
Lumma StealerS1213 ↗
Has checked for debugger strings by invoking GetForegroundWindow and looks for strings containing “x32dbg”, “x64dbg”, “windbg”, “ollydbg”, “dnspy”, “immunity debugger”, “hyperdbg”, “debug”, “debugger”, “cheat engine”, “cheatengine” and “ida”.1
All 24 software entries for this technique · 6 newest in this preview
Offense vs defense T1622
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0
first rule: 2022 Q4 · 1 of 1 campaigns plottedDebugger Evasion detection strategy DET0371
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Debugger Evasion (T1622)
3 platforms
AN1045 · Windows
Monitor for suspicious use of Windows API calls such as IsDebuggerPresent() and NtQueryInformationProcess(), or processes manually checking the BeingDebugged flag in the Process Environment Block (PEB). Detect sequences of OutputDebugStringW() calls in short intervals that may indicate debugger flooding attempts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | etw:Microsoft-Windows-Kernel-Process | NtQueryInformationProcess |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ApiCallFrequencyThreshold | Number of repeated debug-related API calls allowed before raising an alert |
| ProcessAllowList | Legitimate debuggers or developer tools that may trigger similar behaviors |
AN1046 · Linux
Monitor access to /proc/self/status where TracerPID field is queried, as this is a common technique for debugger detection. Detect processes that attempt to trigger exceptions intentionally and monitor whether exception handling indicates presence of a debugger.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File AccessDC0055 | auditd:SYSCALL | open/read: Access to /proc/self/status with focus on TracerPID field |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredPaths | Set of /proc paths to monitor for suspicious access |
| SyscallThreshold | Rate of syscalls (open/read) used to detect repeated probing for debug artifacts |
AN1047 · macOS
Detect suspicious calls to sysctl or ptrace API used to determine if a process is being debugged. Monitor for processes that flood OutputDebugString equivalents or generate abnormal exceptions to evade analysis.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | macos:unifiedlog | ptrace: Processes invoking ptrace with PTRACE_TRACEME flag |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PtraceInvocationThreshold | Number of ptrace calls in a time window that should raise suspicion |
| DevToolExclusionList | Exclude known developer tools and monitoring agents |
Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites0Have cleanup0Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition