{"id":"bdc64095-d59a-42a2-8588-71fd9c9d9abc","title":"Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded","description":"Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes.\nTools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.\nAs an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.\n","author":"Perez Diego (@darkquassar), oscd.community, Ecco","status":"test","level":"high","date":"2019-10-27","modified":"2022-12-09","tags":["attack.credential-access","attack.t1003.001"],"technique_ids":["T1003.001"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Unknown"],"references":["https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump","https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html","https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6"],"source_path":"rules/windows/image_load/image_load_dll_dbghelp_dbgcore_unsigned_load.yml","source_sha256":"91c335e203d93842e7dc0c811724b4c812e1887afd5d83cae167bcb4375babb3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_dll_dbghelp_dbgcore_unsigned_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded\nid: bdc64095-d59a-42a2-8588-71fd9c9d9abc\nrelated:\n    - id: 0e277796-5f23-4e49-a490-483131d4f6e1 # Suspicious Loading\n      type: similar\nstatus: test\ndescription: |\n    Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes.\n    Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.\n    As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.\nreferences:\n    - https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump\n    - https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html\n    - https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6\nauthor: Perez Diego (@darkquassar), oscd.community, Ecco\ndate: 2019-10-27\nmodified: 2022-12-09\ntags:\n    - attack.credential-access\n    - attack.t1003.001\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        ImageLoaded|endswith:\n            - '\\dbghelp.dll'\n            - '\\dbgcore.dll'\n        Signed: 'false'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"}],"data_path":"data/detection-rules/bdc64095-d59a-42a2-8588-71fd9c9d9abc.json","kind":"sigma"}