VMMap Unsigned dbghelp.dll Image Sideloading Attempt on Windows

title: VMMap Unsigned dbghelp.dll Image Sideloading Attempt on Windows
id: f6acd351-b7be-4c06-83d8-c85003bc36d3
related:
  - id: 98ffaed4-aec2-4e04-9b07-31492fe68b3d
    type: similar
  - id: 273a8dd8-3742-4302-bcc7-7df5a80fe425
    type: derived
status: test
description: This rule flags executions of Sysinternals VMMap (vmmap.exe or vmmap64.exe) where it loads a dbghelp.dll from a C:\Debuggers path. It focuses on the scenario where that loaded dbghelp.dll is not signed, which can indicate DLL sideloading for code execution in the context of a legitimate tool. The detection relies on Windows image-load telemetry that records the loaded module path and the signed status of the module.
references:
  - https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v7-1-procdump-2-0-for-linux-process-explorer-v17-05/ba-p/3884766
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_vmmap_dbghelp_unsigned.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-28
modified: 2023-09-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|contains: C:\Debuggers\dbghelp.dll
    Image|endswith:
      - \vmmap.exe
      - \vmmap64.exe
  filter_main_signed:
    Signed: "true"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1