T1622 — Debugger Evasion

Tactics: Stealth, Discovery · Platforms: Linux, macOS, Windows

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads. Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts…

Sigma detection rules (3)

T1622 Debugger Evasion

title: T1622 Debugger Evasion
id: 969850d2-b5fb-49ac-956b-22fb3a97b804
description: 'Detection Strategy for Debugger Evasion (T1622) via Sysmon ProcessAccess events where an unknown process opens a handle to a known debugger/analysis-tool process, consistent with anti-debug enumeration checks. Tune using: GrantedAccessAllowList, ProcessAllowList.'
references:
  - https://attack.mitre.org/techniques/T1622
author: Shahrukh Khan
date: 2026-01-27
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1622

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '10'

  selection_debugger_target:
    TargetImage|endswith:
      - '\x64dbg.exe'
      - '\x32dbg.exe'
      - '\ollydbg.exe'
      - '\windbg.exe'
      - '\ida.exe'
      - '\ida64.exe'
      - '\dbgview.exe'
      - '\immunitydebugger.exe'

  filter_known_inspection_tools:
    SourceImage|endswith:
      - '\procexp.exe'
      - '\procexp64.exe'
      - '\processhacker.exe'

  condition: selection and selection_debugger_target and not filter_known_inspection_tools

falsepositives:
  - Legitimate developer/analyst tooling that also opens handles to debugger executables; this rule replaces a prior CommandLine string-match proxy that could not realistically fire.

level: informational

T1622 Debugger Evasion

title: T1622 Debugger Evasion
id: cacf83ff-25e9-4149-b14e-79cbaa066f5d
description: 'Detection Strategy for Debugger Evasion (T1622). Fixed an internal logsource/field mismatch: category process_access is a Windows/Sysmon-style category, but the detection uses raw auditd SYSCALL/PATH record fields; corrected to category: syscall with service: auditd explicitly set, matching the actual telemetry used. Tune using: MonitoredPaths, SyscallThreshold.'
references:
  - https://attack.mitre.org/techniques/T1622
author: Shahrukh Khan
date: 2026-05-06
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1622

logsource:
  category: syscall
  product: linux
  service: auditd

detection:
  selection:
    type: SYSCALL
    syscall: ptrace
    a0: '0'
  selection_proc:
    type: PATH
    name|contains: '/proc/self/status'

  condition: 1 of selection*

falsepositives:
  - PTRACE_TRACEME (a0=0) self-checks are also performed by legitimate debuggers and sandboxing/hardening frameworks on startup; auditd's SYSCALL threshold (tune SyscallThreshold) needs correlation of repeated anti-debug probes in a short window to separate malware from normal debugger attach handshakes.

level: medium

T1622 Debugger Evasion

title: T1622 Debugger Evasion
id: 52f657f6-1502-4acc-9027-d7d21d4a537c
description: 'Detection Strategy for Debugger Evasion (T1622). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PtraceInvocationThreshold, DevToolExclusionList.'
references:
  - https://attack.mitre.org/techniques/T1622
author: Shahrukh Khan
date: 2026-06-04
license: MIT
tags:
  - attack.stealth
  - attack.discovery
  - attack.t1622

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/lldb'
      - '/dtrace'

  condition: selection

falsepositives:
  - Legitimate software developers routinely use lldb and dtrace for debugging and performance profiling, and the anti-debug check itself (ptrace PT_DENY_ATTACH, sysctl P_TRACED) executes inside process memory with no unified log artifact.

level: medium

Explore