Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.(Citation: ProcessHacker Github)

Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment. Similar to [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497), if the adversary detects a debugger, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for debugger artifacts before dropping secondary or additional payloads.

Specific checks will vary based on the target and/or adversary, but may involve [Native API](https://attack.mitre.org/techniques/T1106) function calls such as <code>IsDebuggerPresent()</code> and <code> NtQueryInformationProcess()</code>, or manually checking the <code>BeingDebugged</code> flag of the Process Environment Block (PEB). Other checks for debugging artifacts may also seek to enumerate hardware breakpoints, interrupt assembly opcodes, time checks, or measurements if exceptions are raised in the current process (assuming a present debugger would “swallow” or handle the potential error).(Citation: hasherezade debug)(Citation: AlKhaser Debug)(Citation: vxunderground debug)

Adversaries may use the information learned from these debugger checks during automated discovery to shape follow-on behaviors. Debuggers can also be evaded by detaching the process or flooding debug logs with meaningless data via messages produced by looping [Native API](https://attack.mitre.org/techniques/T1106) function calls such as <code>OutputDebugStringW()</code>.(Citation: wardle evilquest partii)(Citation: Checkpoint Dridex Jan 2021)
Debugger Evasion
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1622  external_id: T1622     source_name: Checkpoint Dridex Jan 2021  description: Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.  url: https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/     source_name: hasherezade debug  description: hasherezade. (2021, June 30). Module 3 - Understanding and countering malware's evasion and self-defence. Retrieved April 1, 2022.  url: https://github.com/hasherezade/malware_training_vol1/blob/main/slides/module3/Module3_2_fingerprinting.pdf     source_name: AlKhaser Debug  description: Noteworthy. (2019, January 6). Al-Khaser. Retrieved April 1, 2022.  url: https://github.com/LordNoteworthy/al-khaser/tree/master/al-khaser/AntiDebug     source_name: wardle evilquest partii  description: Patrick Wardle. (2020, July 3). OSX.EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021.  url: https://objective-see.com/blog/blog_0x60.html     source_name: ProcessHacker Github  description: ProcessHacker. (2009, October 27). Process Hacker. Retrieved April 11, 2022.  url: https://github.com/processhacker/processhacker     source_name: vxunderground debug  description: vxunderground. (2021, June 30). VX-API. Retrieved April 1, 2022.  url: https://github.com/vxunderground/VX-API/tree/main/Anti%20Debug     