Tagged: #peb

A textbook anti-analysis check that reads the PEB via the IsDebuggerPresent API to detect whether a user-mode debugger is attached to the current process.