Kimsuky Batch Script Debugger-Detection Evasion via tasklist

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects the use of tasklist.exe combined with process filtering (findstr) to identify common debugger names such as 'dbg.exe', 'x64dbg.exe', 'windbg.exe', or 'ollydbg.exe'. This technique is a known evasion tactic employed by the Kimsuky threat group (and others) to check for the presence of analysis tools before continuing execution of malicious batch scripts.