Sigma rule: Potential DLL Sideloading Of DBGCORE.DLL

Rule

Title

Potential DLL Sideloading Of DBGCORE.DLL

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)

Date

2022-10-25

Modified

2025-10-06

File

rules/windows/image_load/image_load_side_load_dbgcore.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects DLL sideloading of "dbgcore.dll"

Log source

product

windows

category

image_load

Detection

selection:
    ImageLoaded|endswith: '\dbgcore.dll'
filter_main_generic:
    ImageLoaded|startswith:
        - 'C:\Program Files (x86)\'
        - 'C:\Program Files\'
        - 'C:\Windows\SoftwareDistribution\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SystemTemp\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\WinSxS\'
filter_optional_steam:
    ImageLoaded|endswith: '\Steam\bin\cef\cef.win7x64\dbgcore.dll'
filter_optional_opera:
    # C:\\Users\\User\\AppData\\Local\\Temp\\.opera\\Opera Installer Temp\\opera_package_202311051506321\\assistant\\dbgcore.dll
    ImageLoaded|contains: 'opera\Opera Installer Temp\opera_package'
    ImageLoaded|endswith: '\assistant\dbgcore.dll'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate applications loading their own versions of the DLL mentioned in this rule

Tags

• attack.persistence
• attack.privilege-escalation
• attack.execution
• attack.stealth
• attack.t1574.001

MITRE ATT&CK ids this rule names

• T1574.001

References

• https://hijacklibs.net/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_side_load_dbgcore.yml