New methods (#93) (#94)

* two new methods * two new methods * two new methods Co-authored-by: Desiree Beck <dbeck@mitre.org>
2026-06-08 11:36:36 +00:00 · 2023-04-26 15:37:32 -04:00
parent 337d99e890
commit b43365cb18
2 changed files with 2 additions and 0 deletions
@@ -46,6 +46,7 @@ Details on methods of detecting debuggers are given in the references; many are
 |**Check Processes**|B0001.038|The malware may check running processes for specific strings such as "malw" to detect a analysis environment.|
 |**CloseHandle**|B0001.003|(NtClose); If an invalid handle is passed to the CloseHandle function and a debugger is present, then an EXCEPTION_INVALID_HANDLE (0xC0000008) exception will be raised. [[7]](#7) This method is related to Unprotect technique U0114.|
 |**Debugger Artifacts**|B0001.004|Malware may detect a debugger by its artifact (window title, device driver, exports, etc.).|
+|**Exception Use**|B0001.039|The malware intentionally causes an exception that is handled by the code and allowed to run to its intended effect; however, an attached debugger will “catch” the exception and pause execution. This method may be combined with the Timing/Delay Check, UnhandledExceptionFilter, or Debugger Evasion::Exception Flooding methods.|
 |**Hardware Breakpoints**|B0001.005|(SEH/GetThreadContext); Debug registers will indicate the presence of a debugger. See [[7]](#7) for details. This method is related to Unprotect technique U0127.|
 |**Interruption**|B0001.006|If an interruption is mishandled by the debugger, it can cause a single-byte instruction to be inadvertently skipped, which can be detected by malware. Examples include Interrupt 0x2d and Interrupt 1 [[7]](#7). This method is related to Unprotect technique U0129.|
 |**IsDebuggerPresent**|B0001.008|The kernel32!IsDebuggerPresent API function call checks the PEB BeingDebugged flag to see if the calling process is being debugged. It returns 1 if the process is being debugged, 0 otherwise. This is one of the most common ways of debugger detection.This method is related to Unprotect technique U0122.|
@@ -48,6 +48,7 @@ The related **Debugger Evasion ([T1622](https://attack.mitre.org/techniques/T162
 |**Change SizeOfImage**|B0002.004|Changing this value during run time can prevent some debuggers from attaching and also confuses some unpackers and dumpers.|
 |**Code Integrity Check**|B0002.005|Check that the unpacking code is unmodified. Variation exists where unpacking code is part of the "key" used to unpack, therefore any Software Breakpoints during debugging causes unpacking to completely fail or result in malformed unpacked code.|
 |**Exception Misdirection**|B0002.006|Using exception handling (SEH) to cause flow of program to non-obvious paths.|
+|**Exception Flooding**|B0002.031|The malware causes numerous intentional exceptions, which are not ignored by the debugger (see Debugger Detection::Exception Use), slowing manual debugging (analyst exhaustion) or preventing automated debugging.|
 |**Get Base Indirectly**|B0002.007|CALL to a POP; finds base of code or data, often the packed version of the code; also used often in obfuscated/packed shellcode.|
 |**Guard Pages**|B0002.008|Encrypt blocks of code individually and decrypt temporarily only upon execution. This method is related to Unprotect technique U0102.|
 |**Hook Interrupt**|B0002.009|Modification of interrupt vector or descriptor tables.|