CrashStealer anti-debugging via ptrace(PT_DENY_ATTACH) and sysctl debugger checks

Duo Tech@duotech

•updated Jul 14, 2026•1•0•4

This rule detects processes command lines containing keywords associated with anti-debugging techniques, such as 'PT_DENY_ATTACH' (a common macOS ptrace flag used to prevent debugger attachment) or generic 'ptrace' and 'sysctl' system calls often leveraged by malware for process introspection or debugger evasion.