{"id":"416bc4a2-7217-4519-8dc7-c3271817f1d5","title":"Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location","description":"Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.\nThese DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-27","modified":"2026-01-09","tags":["attack.credential-access","attack.defense-impairment","attack.t1003","attack.t1685"],"technique_ids":["T1003","T1685"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Unknown"],"references":["https://blog.axelarator.net/hunting-for-edr-freeze/","https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html","https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html"],"source_path":"rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load.yml","source_sha256":"2f0d3c7262faf032ec22817a407baf8c05ee5dabd1fa2840226260a267589700","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location\nid: 416bc4a2-7217-4519-8dc7-c3271817f1d5\nrelated:\n    - id: 9f5c1d59-33be-4e60-bcab-85d2f566effd\n      type: similar\nstatus: experimental\ndescription: |\n    Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.\n    These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.\nreferences:\n    - https://blog.axelarator.net/hunting-for-edr-freeze/\n    - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html\n    - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-27\nmodified: 2026-01-09\ntags:\n    - attack.credential-access\n    - attack.defense-impairment\n    - attack.t1003\n    - attack.t1685\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection_img:\n        Image|contains:\n            - ':\\Perflogs\\'\n            - ':\\Temp\\'\n            - ':\\Users\\Public\\'\n            - '\\$Recycle.Bin\\'\n            - '\\Contacts\\'\n            # - '\\Desktop\\'\n            - '\\Documents\\'\n            # - '\\Downloads\\'\n            - '\\Favorites\\'\n            - '\\Favourites\\'\n            - '\\inetpub\\wwwroot\\'\n            - '\\Music\\'\n            - '\\Pictures\\'\n            - '\\Start Menu\\Programs\\Startup\\'\n            - '\\Users\\Default\\'\n            - '\\Videos\\'\n            #  - '\\AppData\\Local\\Temp\\' some installers may load from here\n    selection_dll:\n        ImageLoaded|endswith:\n            - '\\dbgcore.dll'\n            - '\\dbghelp.dll'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","page":"techniques/enterprise/T1003/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/416bc4a2-7217-4519-8dc7-c3271817f1d5.json","kind":"sigma"}