VMMap Loads Signed dbghelp.dll from C:\Debuggers Path (Potential DLL Sideloading)

title: VMMap Loads Signed dbghelp.dll from C:\Debuggers Path (Potential DLL Sideloading)
id: 890ff5e7-3bdc-494f-b36f-1a174a7d1ac6
related:
  - id: 273a8dd8-3742-4302-bcc7-7df5a80fe425
    type: similar
  - id: 98ffaed4-aec2-4e04-9b07-31492fe68b3d
    type: derived
status: test
description: This rule flags when Sysinternals VMMap loads a signed dbghelp.dll from a specific debug directory path. DLL sideloading enables an attacker to influence which library is loaded by a trusted executable, potentially leading to execution under the context of that process. The detection relies on Windows image load telemetry capturing the loaded DLL path, the loading process (vmmap.exe/vmmap64.exe), and the DLL’s signed status.
references:
  - https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v7-1-procdump-2-0-for-linux-process-explorer-v17-05/ba-p/3884766
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_vmmap_dbghelp_signed.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|contains: C:\Debuggers\dbghelp.dll
    Image|endswith:
      - \vmmap.exe
      - \vmmap64.exe
    Signed: "true"
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1