I've seen that quite a bit of malware (particularly ransomware) checks for a debugger and bails if one is found.
Would it (a) be practical and (b) reduce the risk of a successful malware attack if one either:
attaches a dummy debugger to every userspace process at creation?
has a hook which tells a user's processes that a debugger is attached, if asked? e.g. LD_PRELOAD on Linux, and I believe from WGA cracks that Windows has some API for this too.
I'm assuming that particularly on Windows it may be necessary to have a whitelist of programs not to debug (e.g. commercial software which also bails if being debugged).