Detecting the Presence of a Debugger in Linux, (Tue, Nov 19th)
ID: 63737202-414b-5d86-ad64-fbc70a618d5b
STIX ID: report--63737202-414b-5d86-ad64-fbc70a618d5b
Feed Name: SANS ISC Diary
Threat Score
This blog-style analysis inspects a Python sample that detects debuggers on Windows and Linux (using IsDebuggerPresent and TracerPid in /proc/self/status), demonstrates how TracerPid changes when traced, and provides the sample SHA256 and VirusTotal detection status while noting the payload remains undetermined.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.