Windows 10 Windows Hardening Guide: Locating and Removing Debuggers

Function Get-EnabledDebuggers
{
    $debugRoot = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"

    $IFEOEntries = Get-ChildItem $debugRoot

    foreach($entry in $IFEOEntries)
    {
        if($entry.Name.Contains(".exe"))
        {
            # Convert to powershell path
            $executablePath = $entry.Name.Replace("HKEY_LOCAL_MACHINE","HKLM:")

            $debuggerValue = $null
            $exeName = $executablePath.Substring($executablePath.LastIndexOf('\')+1)
            $debuggerValue = Get-ItemProperty -Path $executablePath -Name "Debugger" -ErrorAction SilentlyContinue

            if($debuggerValue -eq $null)
            {
                Write-Host "No Debugger property found for [$exeName]" -ForegroundColor Green
            }
            elseif ($debuggerValue.Debugger -eq "")
            {
                Write-Host "Debugger property found but contains no value for [$exeName]" -ForegroundColor Yellow
            }
            else
            {
                Write-Host "Debugger property found and contains data for " -NoNewline
                Write-Host "[$exeName]" -ForegroundColor Red
                Write-Host "Debugger value: " -NoNewline
                Write-Host "$($debuggerValue.Debugger)" -ForegroundColor Red
                Write-Host "This could be a sign of malware as this can be used to intercept a process" -ForegroundColor Red
                Write-Host "Some good processes will do this such as procexp.exe from SysInternals if you replace task manager"
            }
        }
    }
}

Get-EnabledDebuggers