Update Process Debug Object Handle detection trick

ayoubfaouzi / al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

GNU General Public License v2.0

5.95k stars 1.18k forks source link

Update Process Debug Object Handle detection trick #195

Closed gsuberland closed 4 years ago

gsuberland commented 5 years ago

Tyranid mentioned our debug object trick in a blog post, and showed that it can be bypassed by the target process modifying the security descriptor of its own debug handle object to contain no ACEs.

We should fix this, checking only for STATUS_PORT_NOT_SET as an error code, rather than just looking to see if the API call fails.

gsuberland commented 4 years ago

Fixed in #197.