StealC-style Anti-Debug: CheckRemoteDebuggerPresent from PowerShell/Injected Hos
Detects the execution of processes that contain command-line arguments indicative of debugger evasion techniques, such as checking for the presence of a debugger using functions like 'IsDebuggerPresent' or 'CheckRemoteDebuggerPresent'. This is commonly associated with malware attempting to evade dynamic analysis in sandboxes or by security researchers.
Cortex XDR
