LegionLoader Anti-Debug: IsDebuggerPresent + SetUnhandledExceptionFilter SEH Manipulation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects common Windows processes (msiexec, cmd, dllhost, or rundll32) attempting to detect the presence of a debugger by calling 'IsDebuggerPresent' or 'SetUnhandledExceptionFilter' within their call stack. This behavior is often associated with malware or malicious tools attempting to evade dynamic analysis in sandbox or debugged environments.