T1622: Debugger Evasion
MITRE ATT&CK T1622: Debugger Evasion Technique details for Linux, macOS, Windows, with detection guidance, relationships and mapped CVEs.
Security context for executives and security teams
Debugger Evasion matters because malware that detects analyst tools can hide its real behavior, stop running, or delay secondary payloads. For leaders, this is a readiness issue: if incident response and malware triage rely only on standard debugging or sandbox workflows, defenders may under-estimate what an intrusion tool can do on real Linux, macOS, or Windows systems.
Executive priority
Prioritize this as a validation topic for SOC and incident response maturity, not as a standalone control purchase. Ask whether malware analysis, endpoint monitoring, and threat hunting can recognize anti-analysis behavior across Windows, Linux, and macOS. The relationship context shows this technique is associated with multiple malware families, including RATs, downloaders, stealers, ransomware-related tools, and macOS malware, so missed visibility can affect triage speed, containment decisions, and evidence quality during incidents.
Technical view
ATT&CK lists Debugger Evasion under stealth and discovery for Linux, macOS, and Windows. Defenders should validate visibility into processes checking for debugger artifacts and changing behavior afterward. Windows-relevant examples in the source include Native API calls such as IsDebuggerPresent(), NtQueryInformationProcess(), OutputDebugStringW(), checks of the PEB BeingDebugged flag, Structured Exception Handling behavior, hardware breakpoint checks, interrupt opcodes, timing checks, and exception handling differences. Linux-relevant examples include reading /proc/self/status and the TracerPID field. Detection engineering should also review DET0371, the related ATT&CK detection strategy, while recognizing that this object itself has no official detection text.
Likely telemetry
- Endpoint process and module telemetry on Windows, Linux, and macOS
- Windows API call or behavioral telemetry where available for debugger-related Native API usage
- File and process access telemetry for Linux reads of /proc/self/status
- Exception, crash, or abnormal process-control telemetry that may show SEH-style anti-debug behavior
- Process timing, repeated debug-string, or log-flooding indicators where EDR or sandbox instrumentation exposes them
Detection direction
- Do not rely only on sandbox output; compare detonation behavior with execution on representative monitored hosts because the technique is designed to alter behavior under analysis.
- Tune for suspicious combinations rather than single API calls, since some debugger checks can appear in legitimate software, packers, diagnostics, or anti-tamper logic.
- For Windows, validate whether telemetry can expose debugger-check APIs, PEB checks, exception-driven control flow, and repeated OutputDebugStringW-style behavior.
- For Linux, validate whether reads of /proc/self/status and TracerPID checks are visible and correlated with unknown or suspicious binaries.
- Use relationship context to enrich hunts around malware families listed by ATT&CK as using this technique, including PlugX, ROKRAT, ThiefQuest, Bumblebee, DarkGate, Raspberry Robin, Pikabot, Latrodectus, LockBit 3.0, and others, without assuming local exposure unless local evidence exists.
Mitigation priorities
- First, ensure incident response procedures treat anti-debug behavior as a reason to escalate analysis, not as a clean result.
- Second, validate endpoint telemetry coverage across Windows, Linux, and macOS systems in scope, especially high-value user and server environments.
- Third, maintain malware analysis workflows that can vary instrumentation and compare behavior across environments to reduce analysis-evasion blind spots.
- Fourth, use threat intelligence from ATT&CK relationships to prioritize detection content for malware families relevant to the organization’s sector, geography, and technology stack.
- Finally, preserve evidence from failed or incomplete detonations, because disengagement or concealed functionality can itself be useful triage context.
Additional notes and limits
This technique is most useful to defenders as a signal of anti-analysis and malware sophistication. It often affects the reliability of conclusions drawn from sandboxing and manual reverse engineering. The supplied relationships show broad use across Windows-focused malware and at least one macOS example, with Linux behavior described in the technique text.
MITRE provides no official detection text for this object. The supplied data supports platforms, examples of debugger checks, and related campaigns/groups/software, but it does not prove current activity, local exposure, or detection coverage in any environment. Local endpoint, sandbox, and IR telemetry must be reviewed before making risk or coverage claims.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Debugger Evasion
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.