{"id":"9f5c1d59-33be-4e60-bcab-85d2f566effd","title":"Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs","description":"Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace.\nThese DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll,\ndbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques.\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-27","modified":"","tags":["attack.credential-access","attack.defense-impairment","attack.t1003.001","attack.t1685"],"technique_ids":["T1003.001","T1685"],"logsource":{"category":"process_access","product":"windows"},"falsepositives":["Possibly during software installation or update processes"],"references":["https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html","https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump"],"source_path":"rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load.yml","source_sha256":"dacc54eb8b938b8c1badfcf2dd299d18a6f31d1e46dacaf7a60e65a9862cc512","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs\nid: 9f5c1d59-33be-4e60-bcab-85d2f566effd\nrelated:\n    - id: 416bc4a2-7217-4519-8dc7-c3271817f1d5\n      type: similar\nstatus: experimental\ndescription: |\n    Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace.\n    These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll,\n    dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques.\nreferences:\n    - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html\n    - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2025-11-27\ntags:\n    - attack.credential-access\n    - attack.defense-impairment\n    - attack.t1003.001\n    - attack.t1685\nlogsource:\n    category: process_access\n    product: windows\ndetection:\n    selection_lsass_calltrace:\n        TargetImage|endswith: '\\lsass.exe'\n        CallTrace|contains:\n            - 'dbgcore.dll'\n            - 'dbghelp.dll'\n    # The following selection is commented out and not enabled by default because any access to LSASS with dbgcore.dll or dbghelp.dll in the call trace from uncommon locations is assumed to be suspicious,\n    # but it may reduce false positives if the rule is too noisy. These GrantedAccess bits are commonly used for dumping LSASS memory.\n    # Uncomment if you observe false positives with the default rule.\n    # selection_granted_access:\n    #     GrantedAccess|contains:\n    #         - '0x1fffff'\n    #         - '0x10'\n    #         - '0x1010'\n    #         - '0x1410'\n    #         - '0x1438'\n    selection_susp_location:\n        SourceImage|contains:\n            - ':\\Perflogs\\'\n            - ':\\Temp\\'\n            - ':\\Users\\Public\\'\n            - '\\$Recycle.Bin\\'\n            - '\\AppData\\Roaming\\'\n            - '\\Contacts\\'\n            - '\\Desktop\\'\n            - '\\Documents\\'\n            - '\\Downloads\\'\n            - '\\Favorites\\'\n            - '\\Favourites\\'\n            - '\\inetpub\\wwwroot\\'\n            - '\\Music\\'\n            - '\\Pictures\\'\n            - '\\Start Menu\\Programs\\Startup\\'\n            - '\\Users\\Default\\'\n            - '\\Videos\\'\n            - '\\Windows\\Temp\\'\n    condition: all of selection_*\nfalsepositives:\n    - Possibly during software installation or update processes\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/9f5c1d59-33be-4e60-bcab-85d2f566effd.json","kind":"sigma"}