TA0005 · DEFENSE EVASION
Debugger Evasion
Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.
Detect it with
Debugger related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.
Why it matters on shift
Debugger Evasion is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context