MITRE ATT&CK technique

Debugger Evasion detection rulesT1622

Debugger Evasion (T1622) is a MITRE ATT&CK technique in the Stealth tactic. This page lists the 1 community-maintained Sigma detection rule in the library mapped to T1622 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.

T1622 on attack.mitre.org1 rule

Tactic

Stealth

PUA - Process Hacker Execution
medium
Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.
windows · process_creation

Top products

Tactic

PUA - Process Hacker Execution