T1622

Debugger Evasion

discovered 2026-06-03

Defense-evasion behaviors around stage-2 launch: detached child spawn with stdio:ignore + unref (fire-and-forget, no output), and console.log saved then nulled to suppress traces.

View on MITRE ATT&CK

Seen in packages

Campaigns