huntrule

WerFaultSecure Loads dbgcore.dll or dbghelp.dll (Windows image_load)

Alerts on WerFaultSecure.exe loading dbgcore.dll or dbghelp.dll, a behavior tied to EDR impairment and potential monitoring evasion.

FreeUnreviewedSigmamediumv1
title: WerFaultSecure Loads dbgcore.dll or dbghelp.dll (Windows image_load)
id: c05327cf-bbce-4a55-bf48-3a49c207b1c4
related:
  - id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c
    type: similar
  - id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2
    type: similar
  - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b
    type: derived
status: experimental
description: This rule flags when WerFaultSecure.exe loads dbgcore.dll or dbghelp.dll. Attackers can use this type of loading activity to disrupt or impede security monitoring, including process suspension behavior seen in EDR-impairment scenarios. Telemetry required is Windows image-load events that provide the loading process path and the DLL path.
references:
  - https://github.com/TwoSevenOneT/EDR-Freeze
  - https://blog.axelarator.net/hunting-for-edr-freeze/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-27
modified: 2026-01-09
tags:
  - attack.defense-impairment
  - attack.t1685
  - detection.threat-hunting
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \WerFaultSecure.exe
    ImageLoaded|endswith:
      - \dbgcore.dll
      - \dbghelp.dll
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules-threat-hunting/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load/info.yml
license: DRL-1.1

What it detects

This rule flags when WerFaultSecure.exe loads dbgcore.dll or dbghelp.dll. Attackers can use this type of loading activity to disrupt or impede security monitoring, including process suspension behavior seen in EDR-impairment scenarios. Telemetry required is Windows image-load events that provide the loading process path and the DLL path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.