Skip to content

Add .NET Environment.TickCount timing anti-debug rule #1137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mike-hunhoff merged 3 commits into from
May 15, 2026
Merged

Add .NET Environment.TickCount timing anti-debug rule #1137

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2f10cb6
Passing all the lint rules and the test
aryanyk Apr 7, 2026
ddccee6
Update nursery/check-for-time-delay-in-dotnet.yml
mike-hunhoff May 15, 2026
2522b8f
Update nursery/check-for-time-delay-in-dotnet.yml
mike-hunhoff May 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions nursery/check-for-time-delay-in-dotnet.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
rule:
meta:
name: check for time delay in .NET
namespace: anti-analysis/anti-debugging
authors:
- "@aryanyk"
description: detects potential debugger checks by comparing Environment.TickCount values around Thread.Sleep calls.
scopes:
static: function
dynamic: unsupported # relies on static analysis of IL property access and timing patterns
att&ck:
- Defense Evasion::Virtualization/Sandbox Evasion [T1497]
mbc:
- Anti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCount [B0001.032]
references:
- https://github.com/Outbuilt/.NET-Anti-Debug
examples:
- e842958188274d5ffee7fbeffb803b2e:0x6000001
features:
- and:
- format: dotnet
- api: System.Threading.Thread::Sleep
- count(property(System.Environment::TickCount)): 2 or more
Loading