AN1045
Analytic 1045
Windows
Monitor for suspicious use of Windows API calls such as IsDebuggerPresent() and NtQueryInformationProcess(), or processes manually checking the BeingDebugged flag in the Process Environment Block (PEB). Detect sequences of OutputDebugStringW() calls in short intervals that may indicate debugger flooding attempts.
WinEventLog:Sysmon
EventCode=1
etw:Microsoft-Windows-Kernel-Process
NtQueryInformationProcess
[ApiCallFrequencyThreshold]
Number of repeated debug-related API calls allowed before raising an alert
[ProcessAllowList]
Legitimate debuggers or developer tools that may trigger similar behaviors
AN1046
Analytic 1046
Linux
Monitor access to /proc/self/status where TracerPID field is queried, as this is a common technique for debugger detection. Detect processes that attempt to trigger exceptions intentionally and monitor whether exception handling indicates presence of a debugger.
auditd:SYSCALL
open/read: Access to /proc/self/status with focus on TracerPID field
[MonitoredPaths]
Set of /proc paths to monitor for suspicious access
[SyscallThreshold]
Rate of syscalls (open/read) used to detect repeated probing for debug artifacts
AN1047
Analytic 1047
macOS
Detect suspicious calls to sysctl or ptrace API used to determine if a process is being debugged. Monitor for processes that flood OutputDebugString equivalents or generate abnormal exceptions to evade analysis.
macos:unifiedlog
ptrace: Processes invoking ptrace with PTRACE_TRACEME flag
[PtraceInvocationThreshold]
Number of ptrace calls in a time window that should raise suspicion
[DevToolExclusionList]
Exclude known developer tools and monitoring agents