check for protected handle exception

rule:
  meta:
    name: check for protected handle exception
    namespace: anti-analysis/anti-debugging/debugger-detection
    authors:
      - michael.hunhoff@mandiant.com
    scopes:
      static: function
      dynamic: thread
    mbc:
      - Anti-Behavioral Analysis::Debugger Detection::SetHandleInformation [B0001.024]
    references:
      - https://github.com/LordNoteworthy/al-khaser/blob/master/al-khaser/AntiDebug/SetHandleInformation_API.cpp
    examples:
      - al-khaser_x86.exe_:0x430D20
  features:
    - and:
      - or:
        - description: SetHandleInformation(hMutex, HANDLE_FLAG_PROTECT_FROM_CLOSE, HANDLE_FLAG_PROTECT_FROM_CLOSE);
        - basic block:
          - and:
            - count(number(2)): 2 or more
            - api: SetHandleInformation
        - call:
          - and:
            - count(number(2)): 2 or more
            - api: SetHandleInformation
      - api: CloseHandle