Debugger Evasion
Technique · ATTACK:enterprise:T1622
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1622",
"title": "Debugger Evasion",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1622",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--e4dc8c01-417f-458d-9ee0-bb0617c1b391",
"external_id": "T1622",
"domain": "enterprise",
"created": "2022-04-01T17:59:46.156Z",
"modified": "2026-09-11T19:39:55.836Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth",
"discovery"
],
"source_references": [
{
"source_name": "Apriorit",
"url": "https://www.apriorit.com/dev-blog/367-anti-reverse-engineering-protection-techniques-to-use-before-releasing-software"
},
{
"source_name": "Checkpoint Dridex Jan 2021",
"url": "https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"
},
{
"source_name": "hasherezade debug",
"url": "https://github.com/hasherezade/malware_training_vol1/blob/main/slides/module3/Module3_2_fingerprinting.pdf"
},
{
"source_name": "Cado Security P2PInfect 2023",
"url": "https://www.cadosecurity.com/blog/p2pinfect-new-variant-targets-mips-devices"
},
{
"source_name": "AlKhaser Debug",
"url": "https://github.com/LordNoteworthy/al-khaser/tree/master/al-khaser/AntiDebug"
},
{
"source_name": "wardle evilquest partii",
"url": "https://objective-see.com/blog/blog_0x60.html"
},
{
"source_name": "ProcessHacker Github",
"url": "https://github.com/processhacker/processhacker"
},
{
"source_name": "Positive Technologies Hellhounds 2023",
"url": "https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/hellhounds-operation-lahat"
},
{
"source_name": "vxunderground debug",
"url": "https://web.archive.org/web/20250904153443/https://github.com/vxunderground/VX-API/tree/main#anti-debug"
}
]
}Explicit source assertions (27)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02c214f7-2c16-462f-9cc0-169c794f4e06
Fortinet LummaStealer 2024ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0324f691-2708-4272-86a5-e0cb40aeba9e
Telefonica Snip3 December 2021ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0644d7f4-edb2-4fbf-81bb-498d1962ad4e
Sophos Mustang Panda PLUGXATTACK:enterprise:S1200 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1199931b-4232-4751-8d7d-5e096bcd3868
Cybereason StealBit Exfiltration ToolATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2157f938-0fce-462e-b0aa-9749414d4972
Fortgale StrelaStealer 2023ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23a7a9eb-b34a-4852-801a-ecab7702bbd8
Trellix Darkgate 2023ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ab5dbba-b0a5-4973-95c0-2d8af10701c5
Cyfirma_Vidar_June2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44a27941-a92a-4dd8-ab62-e30f6d8782e3
Zscaler Pikabot 2023 · Elastic Pikabot 2024 · Logpoint Pikabot 2024ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4eb00375-3ee3-43c7-845a-2206e1eff114
Malwarebytes RokRAT VBA January 2021 · Talos Group123 · NCCGroup RokRat Nov 2018ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5013757f-2af8-43ce-b0cd-b625ca0bcf58
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · 2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:S0694 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50446870-ba6c-4d0c-b657-586a6cba8903
ClearSky Lazarus Aug 2020ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6bc08584-0dc8-494f-967f-50adc9464843
Check Point Black Basta October 2022ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7073777a-12f6-4afa-aa0d-8be1b29cf63b
Zscaler PureCrypter JUN 2022ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--885a3674-5a25-42e4-aa7f-148a41493861
Malwarebytes Saint Bot April 2021ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ce98ef3-1951-460b-93c6-2ded0edc8dfd
2022 November_TrendMicro_Earth Preta_Toneshell_Pubload · Sophos Mustang Panda PLUGXATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a64c7c7d-f08c-40a3-802b-e25fe9eaea6c
CloudSEK_RustyWater_Jan2026ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9db541b-987a-4416-a721-3d59012b86e5
Google XLoader 2017ATTACK:enterprise:S9027 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac588a85-7bc7-447a-8ebd-243af2a8dd62
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0e22e39-2b6c-4b27-8fd1-e9855194449e
TrendMicro RaspberryRobin 2022ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b66fc48f-d106-493c-9c32-4037288b9fb7
2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6e9f75a-6cf1-400a-a282-a43214dfb729
Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcf36359-e8be-4842-8174-489a679f32a4
ClearSky Lazarus Aug 2020ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6cc5a76-522d-4b48-ae5b-4867fa87f2c6
Secureworks DarkTortilla Aug 2022ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cce43f73-d564-4c60-9492-52b3f7039b7b
SentinelLabs Metador Technical Appendix Sept 2022ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e711d51c-94d3-4a20-ae11-d3584bae36d9
wardle evilquest partiiATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ebb04a61-225d-4cd3-b589-b3001069566e
Latrodectus APR 2024ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f015b898-b057-40e4-9add-c4fa1e100f7e
Medium Ali Salem Bumblebee April 2022