WerFaultSecure.exe Loading dbgcore.dll or dbghelp.dll (Windows image load)
Alerts on WerFaultSecure.exe loading dbgcore.dll or dbghelp.dll, a behavior tied to EDR impairment and potential monitoring evasion.
- Product
- windows
- Category
- image_load
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-11-27
- Updated
- 2026-07-31
What it detects
This rule flags Windows processes where WerFaultSecure.exe loads dbgcore.dll or dbghelp.dll. Attackers may leverage this behavior as part of defense-impairment tactics to disrupt or evade security monitoring. The detection relies on image load telemetry that records the loaded DLL path and the loading process executable, and it should be investigated alongside other concurrent process activity, network connections, and file changes. Be aware that similar DLL loads can also occur during legitimate software installations, so confirm suspicious context around the DLL load timing.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: WerFaultSecure.exe Loading dbgcore.dll or dbghelp.dll (Windows image load)
id: c05327cf-bbce-4a55-bf48-3a49c207b1c4
related:
- id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c
type: similar
- id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2
type: similar
- id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b
type: derived
status: experimental
description: This rule flags Windows processes where WerFaultSecure.exe loads dbgcore.dll or dbghelp.dll. Attackers may leverage this behavior as part of defense-impairment tactics to disrupt or evade security monitoring. The detection relies on image load telemetry that records the loaded DLL path and the loading process executable, and it should be investigated alongside other concurrent process activity, network connections, and file changes. Be aware that similar DLL loads can also occur during legitimate software installations, so confirm suspicious context around the DLL load timing.
references:
- https://github.com/TwoSevenOneT/EDR-Freeze
- https://blog.axelarator.net/hunting-for-edr-freeze/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-27
modified: 2026-01-09
tags:
- attack.defense-impairment
- attack.t1685
- detection.threat-hunting
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith: \WerFaultSecure.exe
ImageLoaded|endswith:
- \dbgcore.dll
- \dbghelp.dll
condition: selection
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules-threat-hunting/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load/info.yml
license: DRL-1.1