Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1622: Debugger Evasion

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.[1]

Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment. Similar to Virtualization/Sandbox Evasion, if the adversary detects a debugger, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for debugger artifacts before dropping secondary or additional payloads.

Specific checks will vary based on the target and/or adversary. On Windows, this may involve Native API function calls such as IsDebuggerPresent() and NtQueryInformationProcess(), or manually checking the BeingDebugged flag of the Process Environment Block (PEB). On Linux, this may involve querying `/proc/self/status` for the `TracerPID` field, which indicates whether or not the process is being traced by dynamic analysis tools.[2][3] Other checks for debugging artifacts may also seek to enumerate hardware breakpoints, interrupt assembly opcodes, time checks, or measurements if exceptions are raised in the current process (assuming a present debugger would “swallow” or handle the potential error).[4][5][6]

Malware may also leverage Structured Exception Handling (SEH) to detect debuggers by throwing an exception and detecting whether the process is suspended. SEH handles both hardware and software expectations, providing control over the exceptions including support for debugging. If a debugger is present, the program’s control will be transferred to the debugger, and the execution of the code will be suspended. If the debugger is not present, control will be transferred to the SEH handler, which will automatically handle the exception and allow the program’s execution to continue.[7]

Adversaries may use the information learned from these debugger checks during automated discovery to shape follow-on behaviors. Debuggers can also be evaded by detaching the process or flooding debug logs with meaningless data via messages produced by looping Native API function calls such as OutputDebugStringW().[8][9]

EnterpriseT1622TechniqueObject v2.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Debugger Evasion matters because malware that detects analyst tools can hide its real behavior, stop running, or delay secondary payloads. For leaders, this is a readiness issue: if incident response and malware triage rely only on standard debugging or sandbox workflows, defenders may under-estimate what an intrusion tool can do on real Linux, macOS, or Windows systems.

Executive priority

Prioritize this as a validation topic for SOC and incident response maturity, not as a standalone control purchase. Ask whether malware analysis, endpoint monitoring, and threat hunting can recognize anti-analysis behavior across Windows, Linux, and macOS. The relationship context shows this technique is associated with multiple malware families, including RATs, downloaders, stealers, ransomware-related tools, and macOS malware, so missed visibility can affect triage speed, containment decisions, and evidence quality during incidents.

Technical view

ATT&CK lists Debugger Evasion under stealth and discovery for Linux, macOS, and Windows. Defenders should validate visibility into processes checking for debugger artifacts and changing behavior afterward. Windows-relevant examples in the source include Native API calls such as IsDebuggerPresent(), NtQueryInformationProcess(), OutputDebugStringW(), checks of the PEB BeingDebugged flag, Structured Exception Handling behavior, hardware breakpoint checks, interrupt opcodes, timing checks, and exception handling differences. Linux-relevant examples include reading /proc/self/status and the TracerPID field. Detection engineering should also review DET0371, the related ATT&CK detection strategy, while recognizing that this object itself has no official detection text.

Likely telemetry

  • Endpoint process and module telemetry on Windows, Linux, and macOS
  • Windows API call or behavioral telemetry where available for debugger-related Native API usage
  • File and process access telemetry for Linux reads of /proc/self/status
  • Exception, crash, or abnormal process-control telemetry that may show SEH-style anti-debug behavior
  • Process timing, repeated debug-string, or log-flooding indicators where EDR or sandbox instrumentation exposes them

Detection direction

  • Do not rely only on sandbox output; compare detonation behavior with execution on representative monitored hosts because the technique is designed to alter behavior under analysis.
  • Tune for suspicious combinations rather than single API calls, since some debugger checks can appear in legitimate software, packers, diagnostics, or anti-tamper logic.
  • For Windows, validate whether telemetry can expose debugger-check APIs, PEB checks, exception-driven control flow, and repeated OutputDebugStringW-style behavior.
  • For Linux, validate whether reads of /proc/self/status and TracerPID checks are visible and correlated with unknown or suspicious binaries.
  • Use relationship context to enrich hunts around malware families listed by ATT&CK as using this technique, including PlugX, ROKRAT, ThiefQuest, Bumblebee, DarkGate, Raspberry Robin, Pikabot, Latrodectus, LockBit 3.0, and others, without assuming local exposure unless local evidence exists.

Mitigation priorities

  • First, ensure incident response procedures treat anti-debug behavior as a reason to escalate analysis, not as a clean result.
  • Second, validate endpoint telemetry coverage across Windows, Linux, and macOS systems in scope, especially high-value user and server environments.
  • Third, maintain malware analysis workflows that can vary instrumentation and compare behavior across environments to reduce analysis-evasion blind spots.
  • Fourth, use threat intelligence from ATT&CK relationships to prioritize detection content for malware families relevant to the organization’s sector, geography, and technology stack.
  • Finally, preserve evidence from failed or incomplete detonations, because disengagement or concealed functionality can itself be useful triage context.
Analyst notes and limits

This technique is most useful to defenders as a signal of anti-analysis and malware sophistication. It often affects the reliability of conclusions drawn from sandboxing and manual reverse engineering. The supplied relationships show broad use across Windows-focused malware and at least one macOS example, with Linux behavior described in the technique text.

MITRE provides no official detection text for this object. The supplied data supports platforms, examples of debugger checks, and related campaigns/groups/software, but it does not prove current activity, local exposure, or detection coverage in any environment. Local endpoint, sandbox, and IR telemetry must be reviewed before making risk or coverage claims.

Official MITRE ATT&CK definition

Debugger Evasion

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.[1]

Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment. Similar to Virtualization/Sandbox Evasion, if the adversary detects a debugger, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for debugger artifacts before dropping secondary or additional payloads.

Specific checks will vary based on the target and/or adversary. On Windows, this may involve Native API function calls such as IsDebuggerPresent() and NtQueryInformationProcess(), or manually checking the BeingDebugged flag of the Process Environment Block (PEB). On Linux, this may involve querying `/proc/self/status` for the `TracerPID` field, which indicates whether or not the process is being traced by dynamic analysis tools.[2][3] Other checks for debugging artifacts may also seek to enumerate hardware breakpoints, interrupt assembly opcodes, time checks, or measurements if exceptions are raised in the current process (assuming a present debugger would “swallow” or handle the potential error).[4][5][6]

Malware may also leverage Structured Exception Handling (SEH) to detect debuggers by throwing an exception and detecting whether the process is suspended. SEH handles both hardware and software expectations, providing control over the exceptions including support for debugging. If a debugger is present, the program’s control will be transferred to the debugger, and the execution of the code will be suspended. If the debugger is not present, control will be transferred to the SEH handler, which will automatically handle the exception and allow the program’s execution to continue.[7]

Adversaries may use the information learned from these debugger checks during automated discovery to shape follow-on behaviors. Debuggers can also be evaded by detaching the process or flooding debug logs with meaningless data via messages produced by looping Native API function calls such as OutputDebugStringW().[8][9]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G0129: Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

Tool Enterprise

S1087: AsyncRAT

AsyncRAT is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.[1][2][3]

Windows
Malware Enterprise

S1200: StealBit

StealBit is a data exfiltration tool that is developed and maintained by the operators of the the LockBit Ransomware-as-a-Service (RaaS) and offered to affiliates to exfiltrate data from compromised systems for double extortion purposes.[1][2]

Windows
Malware Enterprise

S1183: StrelaStealer

StrelaStealer is an information stealer malware variant first identified in November 2022 and active through late 2024. StrelaStealer focuses on the automated identification, collection, and exfiltration of email credentials from email clients such as Outlook and Thunderbird.[1][2][3][4]

Windows
Malware Enterprise

S1111: DarkGate

DarkGate first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, DarkGate is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.[1] DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.[2]

Windows
Malware Enterprise

S1145: Pikabot

Pikabot is a backdoor used for initial access and follow-on tool deployment active since early 2023. Pikabot is notable for extensive use of multiple encoding, encryption, and defense evasion mechanisms to evade defenses and avoid analysis. Pikabot has some overlaps with QakBot, but insufficient evidence exists to definitively link these two malware families. Pikabot is frequently used to deploy follow on tools such as Cobalt Strike or ransomware variants.[1][2][3]

Windows
Malware Enterprise

S1228: PUBLOAD

PUBLOAD is a stager malware that has been observed installing itself in existing directories such as `C:\Users\Public` or creating new directories to stage the malware and its components.[1] PUBLOAD malware collects details of the victim host, establishes persistence, encrypts victim details using RC4 and communicates victim details back to C2. PUBLOAD malware has previously been leveraged by China-affiliated actors identified as Mustang Panda. PUBLOAD is also known as “NoFive” and some public reporting identifies the loader component as CLAIMLOADER.[2]

Windows
Malware Enterprise

S1070: Black Basta

Black Basta is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and VMWare ESXi servers. Black Basta operations have included the double extortion technique where in addition to demanding ransom for decrypting the files of targeted organizations the cyber actors also threaten to post sensitive information to a leak site if the ransom is not paid. Black Basta affiliates have targeted multiple high-value organizations, with the largest number of victims based in the U.S. Based on similarities in TTPs, leak sites, payment sites, and negotiation tactics, security researchers assess the Black Basta RaaS operators could include current or former members of the Conti group.[1][2][3][4][5][6]

WindowsESXi
Malware Enterprise

S9019: PureCrypter

PureCrypter is a fully-featured malware loader, developed by a threat actor called “PureCoder," that has been in use since at least 2021 to distribute a variety of remote access trojans and information stealers.[1]

Windows
Campaign Enterprise

C0022: Operation Dream Job

Operation Dream Job was a cyber espionage operation likely conducted by Lazarus Group that targeted the defense, aerospace, government, and other sectors in the United States, Israel, Australia, Russia, and India. In at least one case, the cyber actors tried to monetize their network access to conduct a business email compromise (BEC) operation. In 2020, security researchers noted overlapping TTPs, to include fake job lures and code similarities, between Operation Dream Job, Operation North Star, and Operation Interception; by 2022 security researchers described Operation Dream Job as an umbrella term covering both Operation Interception and Operation North Star.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · Malware S1213: Lumma Stealer Enterprise uses · Tool S1087: AsyncRAT Enterprise uses · Malware S0013: PlugX Enterprise uses · Malware S1200: StealBit Enterprise uses · Malware S1183: StrelaStealer Enterprise uses · Malware S1111: DarkGate Enterprise uses · Malware S1145: Pikabot Enterprise uses · Malware S0240: ROKRAT Enterprise uses · Malware S1228: PUBLOAD Enterprise uses · Malware S0694: DRATzarus Enterprise uses · Malware S1070: Black Basta Enterprise uses · Malware S9019: PureCrypter Enterprise uses · Malware S1018: Saint Bot Enterprise uses · Group G0129: Mustang Panda Enterprise uses · Malware S9037: RustyWater Enterprise uses · Malware S1207: XLoader Enterprise uses · Malware S9027: ANELLDR Enterprise uses · Malware S1130: Raspberry Robin Enterprise uses · Malware S1239: TONESHELL Enterprise uses · Malware S1202: LockBit 3.0 Enterprise uses · Campaign C0022: Operation Dream Job Enterprise uses · Malware S1066: DarkTortilla Enterprise uses · Malware S1060: Mafalda Enterprise detects · Detection Strategy DET0371: Detection Strategy for Debugger Evasion (T1622) Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
2f8f29597001c63a...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.0 Current bundle 2f8f29597001…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ProcessHacker Github

    ProcessHacker. (2009, October 27). Process Hacker. Retrieved April 11, 2022.

    Open source URL
  2. [2]
    Cado Security P2PInfect 2023

    jbowen. (2023, December 4). P2Pinfect - New Variant Targets MIPS Devices. Retrieved March 18, 2025.

    Open source URL
  3. [3]
    Positive Technologies Hellhounds 2023

    PT Expert Security Center. (2023, November 29). Hellhounds: operation Lahat. Retrieved March 18, 2025.

    Open source URL
  4. [4]
    hasherezade debug

    hasherezade. (2021, June 30). Module 3 - Understanding and countering malware's evasion and self-defence. Retrieved April 1, 2022.

    Open source URL
  5. [5]
    AlKhaser Debug

    Noteworthy. (2019, January 6). Al-Khaser. Retrieved April 1, 2022.

    Open source URL
  6. [6]
    vxunderground debug

    vxunderground. (2021, June 30). VX-API. Retrieved April 1, 2022.

    Open source URL
  7. [7]
    Apriorit

    Apriorit. (2024, June 4). Anti Debugging Protection Techniques with Examples. Retrieved March 4, 2025.

    Open source URL
  8. [8]
    wardle evilquest partii

    Patrick Wardle. (2020, July 3). OSX.EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021.

    Open source URL
  9. [9]
    Checkpoint Dridex Jan 2021

    Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.

    Open source URL
  10. [10]
    mitre-attack T1622
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use