Sigma rule: Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process

Rule

Title

Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process

Status

test

Level

medium

Author

Perez Diego (@darkquassar), oscd.community, Ecco

Date

2019-10-27

Modified

2024-03-01

File

rules-threat-hunting/windows/image_load/image_load_dll_dbghelp_dbgcore_susp_load.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the load of dbghelp/dbgcore DLL by a potentially uncommon or potentially suspicious process.
The Dbghelp and Dbgcore DLLs export functions that allow for the dump of process memory. Tools like ProcessHacker, Task Manager and some attacker tradecraft use the MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
Keep in mind that many legitimate Windows processes and services might load the aforementioned DLLs for debugging or other related purposes. Investigate the CommandLine and the Image location of the process loading the DLL.

Log source

product

windows

category

image_load

Detection

selection:
    ImageLoaded|endswith:
        - '\dbghelp.dll'
        - '\dbgcore.dll'
    Image|endswith:
        - '\bash.exe'
        - '\cmd.exe'
        - '\cscript.exe'
        - '\dnx.exe'
        - '\excel.exe'
        - '\monitoringhost.exe'
        - '\msbuild.exe'
        - '\mshta.exe'
        - '\outlook.exe'
        - '\powerpnt.exe'
        - '\regsvcs.exe'
        - '\rundll32.exe'
        - '\sc.exe'
        - '\scriptrunner.exe'
        - '\winword.exe'
        - '\wmic.exe'
        - '\wscript.exe'
        # - '\powershell.exe' # Note: Triggered by installing common software
        # - '\regsvr32.exe'  # Note: triggered by installing common software
        # - '\schtasks.exe'  # Note: triggered by installing software
        # - '\svchost.exe'  # Note: triggered by some services
filter_main_tiworker:
    # Note: This filter requires "CommandLine" field enrichment
    CommandLine|startswith: 'C:\WINDOWS\WinSxS\'
    CommandLine|endswith: '\TiWorker.exe -Embedding'
filter_main_generic:
    # Note: This filter requires "CommandLine" field enrichment
    Image|endswith: '\svchost.exe'
    CommandLine|endswith:
        - '-k LocalServiceNetworkRestricted'
        - '-k WerSvcGroup'
filter_main_rundll32:
    # Note: This filter requires "CommandLine" field enrichment
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
        - '/d srrstr.dll,ExecuteScheduledSPPCreation'
        - 'aepdu.dll,AePduRunUpdate'
        - 'shell32.dll,OpenAs_RunDL'
        - 'Windows.Storage.ApplicationData.dll,CleanupTemporaryState'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Debugging scripts might leverage this DLL in order to dump process memory for further analysis.

Tags

• attack.credential-access
• attack.t1003.001
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1003.001

Related rules

• bdc64095-d59a-42a2-8588-71fd9c9d9abc (similar)

References

• https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
• https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
• https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/image_load/image_load_dll_dbghelp_dbgcore_susp_load.yml