Windows VMMap Loading Unsigned dbghelp.dll from C:\Debuggers\dbghelp.dll

Alerts when VMMap loads an unsigned dbghelp.dll from C:\Debuggers, suggesting DLL sideloading on Windows.

FreeReviewedSigma · High · v2

Product: windows
Category: image_load
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-07-28
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags image loads where VMMap (vmmap.exe or vmmap64.exe) loads dbghelp.dll from C:\Debuggers\dbghelp.dll without a valid signed indication. Unsigned DLL sideloading can be used to run attacker-controlled code in the context of a legitimate signed tool. The detection relies on process image load events that capture the loaded DLL path and VMMap executable identity.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Suspicious msimg32.dll Loaded from Non-System Directory

DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

Suspicious Cortex XDR Binary Sideloading winutils.dll (via image_load)

Windows VMMap Loading Unsigned dbghelp.dll from C:\Debuggers\dbghelp.dll

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

vmmap-unsigned-dbghelp-dll-image-sideloading-attempt-on-windows-273a8dd8

title: Windows VMMap Loading Unsigned dbghelp.dll from C:\Debuggers\dbghelp.dll
id: f6acd351-b7be-4c06-83d8-c85003bc36d3
related:
  - id: 98ffaed4-aec2-4e04-9b07-31492fe68b3d
    type: similar
  - id: 273a8dd8-3742-4302-bcc7-7df5a80fe425
    type: derived
status: test
description: This rule flags image loads where VMMap (vmmap.exe or vmmap64.exe) loads dbghelp.dll from C:\Debuggers\dbghelp.dll without a valid signed indication. Unsigned DLL sideloading can be used to run attacker-controlled code in the context of a legitimate signed tool. The detection relies on process image load events that capture the loaded DLL path and VMMap executable identity.
references:
  - https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v7-1-procdump-2-0-for-linux-process-explorer-v17-05/ba-p/3884766
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_vmmap_dbghelp_unsigned.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-28
modified: 2023-09-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|contains: C:\Debuggers\dbghelp.dll
    Image|endswith:
      - \vmmap.exe
      - \vmmap64.exe
  filter_main_signed:
    Signed: "true"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL