Update hide-thread-from-debugger.yml

mandiant · Jul 5, 2023 · 299ba42 · 299ba42
1 parent a8b8558
commit 299ba42
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml b/anti-analysis/anti-debugging/debugger-evasion/hide-thread-from-debugger.yml
@@ -28,6 +28,6 @@ rule:
         - or:
           - string: "NtSetInformationThread"
           - string: "ZwSetInformationThread"
-        - api: GetProcAddress
+        - match: link function at runtime on Windows
         - api: GetCurrentThread
         - number: 0x11 = ThreadHideFromDebugger