check-for-debugger-via-api.yml

rule:
  meta:
    name: check for debugger via API
    namespace: anti-analysis/anti-debugging/debugger-detection
    author: michael.hunhoff@mandiant.com
    scope: function
    mbc:
      - Anti-Behavioral Analysis::Debugger Detection::CheckRemoteDebuggerPresent [B0001.002]
      - Anti-Behavioral Analysis::Debugger Detection::WudfIsAnyDebuggerPresent [B0001.031]
    references:
      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/CheckRemoteDebuggerPresent.cpp
    examples:
      - al-khaser_x86.exe_:0x420000
  features:
    - or:
      - api: kernel32.CheckRemoteDebuggerPresent
      - api: WUDFPlatform.WudfIsAnyDebuggerPresent
      - api: WUDFPlatform.WudfIsKernelDebuggerPresent
      - api: WUDFPlatform.WudfIsUserDebuggerPresent